Wireless On the Go

802.11ac vs 802.11ax (Wi-Fi6)

2019-10-10T23:50:36.124000Z

A quick table showcasing the difference between the two standards

Source: http://www.ni.com/en-us/innovations/white-papers/16/introduction-to-802-11ax-high-efficiency-wireless.html

Cisco Webex Meetings and Cisco Webex Teams

2018-08-02T21:23:35.791000Z

New Cisco Webex Meetings Experience

Cisco Webex Teams

Cisco Webex Teams Security

Cisco Wireless Access Point 4800

2018-04-25T13:10:34.680000Z

Cisco Access Point 4800

Uhoh, This content has sprouted legs and trotted off.

Datasheet

https://www.cisco.com/c/en/us/products/collateral/wireless/aironet-4800-access-point/nb-09-air-4800-acces-ds-cte-en.html

Cisco DNA Assurance Analytics

2018-03-19T14:48:34.766000Z

Cisco DNA Assurance

Cisco Business Critical Insights

2018-02-26T15:15:39.478000Z

Business critical insights is an offering delivered under Business Critical Services. This dashboard gives you near real time information about what is happening across your entire network. It shows information on network changes happened over the last 24 hours, crashes, reloads etc. all powered through AI and machine learning. This lets to proactively identity certain issues even before they actually happen by intelligently processing and applying years of Cisco IP to syslog information.

Business Critical Insights Quick Overview

Compliance and Remediation

Compliance and Remediation enables the achievement of successful outcomes by implementing Cisco recommendations, automatically. Learn more here: http://cs.co/6004DE57q

Incident Response

Incident Responses Retainer is a foundational service that enables you to respond fast to security attacks and proactively prevent them. Learn more here: http://cs.co/6004DE57q

What is Netflow?

2018-01-26T02:51:17.753000Z

For anyone getting started with Netflow and related topics (Sflow, AVC etc.), found a couple of very short and simple videos explaining basics of Netflow.

Cisco DNA Center Assurance Analytics

2018-01-03T19:35:00.645000Z

High level benefits

Cisco DNA Center provides an easy-to-use single dashboard for monitoring network health, identifying issue root causes, evaluating network configuration changes, and remediating issues

Cisco Network Data Platform (NDP), collects data from multiple network sources to deliver comprehensive visibility into devices, users, and applications for proper context and correlation

Advanced correlation and machine learning algorithms proactively identify outliers that are reported as issues for remediation

Sensors proactively generate synthetic application and network traffic to probe wireless network performance

Recommended remediation options are driven by 30 years of Cisco domain expertise and best practices

Integration with automation workflows enables users to quickly remediate the issue

Open APIs can be used to integrate data with third-party analytics applications

source: https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise-networks/digital-network-architecture/at-a-glance-c45-738905.pdf

Cisco Mobility Design Guide - 8.5

2017-11-04T00:03:18.745000Z

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-5/Enterprise-Mobility-8-5-Design-Guide/Enterprise_Mobility_8-5_Deployment_Guide.html

Using Tetration to Implement Zero Trust Networking

2017-10-27T14:09:19.241000Z

Cisco WLC 8.5 Config Guides

2017-08-31T16:46:26.041000Z

Mobility Express FlexConnect Feature Matrix -https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-5/b_Mobility_Express_FlexConnect_Feature_Matrix.html

SD-Access Wireless Deployment Guide -https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-5/b_SD_Access_Wireless_Deployment_Guide.html

Feature Matrix for 802.11ac Wave 2 Access Points - https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-5/b_feature_matrix_for_802_11ac_wave2_access_points.html

Cisco Aironet 1815T (Teleworker) Access Point Deployment Guide -https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-5/b_Cisco_Aironet_1815_Teleworker_Access_Point.html

Cisco Wireless LAN Controller Configuration Best Practices - https://www.cisco.com/c/en/us/td/docs/wireless/technology/wlc/8-5/82463-wlc-config-best-practice.html

Cisco Mobility Express Deployment Guide Release 8.5 -https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-5/b_cisco_mobility_express_8_5.html

WLC 3504 Release 8.5 Deployment Guide - https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-5/b_WLC_3504_Release_8_5_Deployment_Guide.html

8.5 Identity PSK Feature Deployment Guide -https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-5/b_Identity_PSK_Feature_Deployment_Guide.html

TechWiseTV: New Servers, Better System. Reintroducing Cisco UCS

2017-08-01T16:47:45.622000Z

Catalyst 9000 Series and Open IOS-XE: The New Era of Programmability

2017-07-17T13:47:12.119000Z

Catalyst 9000 Series: Programmability and Software-Defined Access

2017-07-17T13:36:34.261000Z

Time of 'WannaCry' Ransomware Defense

2017-05-18T14:05:08.790000Z

Feature Matrix for 802.11ac Wave 2 Access Points

2017-05-18T14:00:37.930000Z

RF Feature Matrix

Features	AP18xx	AP3800/2800	AP1560
CleanAir 80Mhz	n/a	Yes	Yes
RRM–DCA, TPC, CHDM	Yes	Yes	Yes
FRA	n/a	Yes	n/a
BandSelect	Yes	Yes	Yes
Load Balancing	Yes	Yes	Yes
RF Profiles	Yes	Yes	Yes
HDX Turbo Performance	No	Yes	Yes
Optimized Roaming	Yes	Yes	Yes
RX–SOP	No	Yes	Yes
DBS	Yes	Yes	Yes
Off-channel scanning	Yes	Yes	Yes
Offchannel Scan Defer	Yes	Yes	Yes
Flex DFS	No	Yes	Yes
ClientLink 4.0	TxBF	Yes	Yes
ATF	No	No	No
A-MSDU/A-MPDU aggregation config per priority	Yes	Yes	Yes
EDRRM	No	Yes	Yes
Configurable EDCA	No	No	No

Security Feature Matrix–Local Mode AP

Features	AP18xx	AP3800/2800	AP1560
802.1x on AP port	No	No	No
WPA2/AES	Yes	Yes	Yes
TKIP	Yes	Yes	Yes
Peer to Peer Blocking	Yes	Yes	Yes
Wireless IDS	Yes	Yes	Yes
Adaptive wIPS	MSE 8.0	MSE 8.0	MSE 8.0
ELM	Yes–limited	Yes	Yes
Client exclusion	Yes	Yes	Yes
Rogue detection	Yes	Yes	Yes
MFP	No	No	No
11r, 11k, 11v BSS transition Management	Yes	Yes	Yes
802.11v DMS	No	No	No
802.11w	Yes	Yes	Yes
Local Policy w/QoS and AVC	Yes	Yes	Yes
Trustsec SXP, SGT	8.4	8.4	8.4
WEP	Deprecated	Deprecated	Deprecated
WiFi Direct blocking	No	No	No
LSC	Yes	Yes	Yes
TCP MSS Adjust*	Yes	Yes	Yes
MAC Authentication	Yes	Yes	Yes
OKC	Yes	Yes	Yes
CCKM	Yes	Yes	Yes
NDP Encryption	No	No	No
Data DTLS Encryption	Yes	Yes	Yes

Services Feature Matrix–Local Mode

Features	AP18xx	AP3800/2800	AP1560
AVC–Mark, Drop, RL	Yes	Yes	Yes
AAA Override–VLAN, ACL, QoS	Yes	Yes	Yes
AAA Override of AVC profile	Yes	Yes	Yes
AAA Override BW contract	Yes	Yes	Yes
Local Profiling	Yes	Yes	Yes
Radius Profiling	No	No	No
Per User BW contract	Yes	Yes	Yes
Per SSID BW contract	Yes	Yes	Yes
Videostream	Yes	Yes	Yes
CAC, WMM Policy	Yes	Yes	Yes
QoS Profiles	Yes	Yes	Yes
Bonjour GW, mDNS AP, LSS, Priority MAC	Yes	Yes	Yes
Adaptive 11r	8.3 MR1	8.3 MR1	8.3 MR1
Fastlane	8.3 MR1	8.3 MR1	8.3 MR1
Mac Authentication	Yes	Yes	Yes
802.11u	No	No	No
Full CCX Support	No	No	No
BYOD, NAC RADIUS, CWA	Yes	Yes	Yes

Infrastructure Feature Matrix

Features	AP18xx	AP 3800/2800	AP1560
CDP, LLDP	Yes	Yes	Yes
HA SSO	Yes	Yes	Yes
AP Multicast mode	Yes	Yes	Yes
Multicast VLAN	Yes	Yes	Yes
Client IPv6	Yes	Yes	Yes
Webauth–Internal/External	Yes	Yes	Yes
AP PnP	8.3	8.3	8.3
Pre Image Download	Yes	Yes	Yes
Fast SSID Change	Yes	Yes	Yes
FlexConnect, Local, Sniffer and Monitor Mode	Yes (No Monitor Mode)	Yes	Yes
Mesh Mode	No	No	8.4 MR1
Spectrum Expert, Indoor Flex +Mesh	No	No	No
Mobility Express	Yes (No ME for 1810)	8.3	8.3
RFIDTagging	8.3 MR1	8.3 MR1	8.3 MR1
FIPS Certification	8.3 MR1	8.3 MR1	8.3 MR1
Native IPv6	8.4	8.4	8.4
BLE, Fastlocate, Hyperlocation	No	No	No
WGB mode	No	No	No
Fast CAPWAP Heartbeat	No	No	No
Client Packet Capture	No	No	No
CAPWAP VLAN Tagging	No	No	No
User idle timeout per WLAN	Yes	Yes	Yes
User idle thresholds per WLAN	Yes	Yes	Yes
DHCP Option 60	No	No	No

FlexConnect Specific–Feature Matrix

Features	AP18X	AP3800 AP2800	AP1560
Local Switching	Yes	Yes	Yes
Central Switching	Yes	Yes	Yes
WLAN-VLAN Mapping	Yes	Yes	Yes
Local Auth w/External RADIUS Server	Yes	Yes	Yes
Local Auth internal Server	No	No	No
TKIP	8.2MR5/8.3MR1	8.2MR5/8.3MR1	Yes
WPA2/AES	Yes	Yes	Yes
OEAP	Yes	Yes	Yes
Webauth–Internal/External	Yes	Yes	Yes
EoGREv4/v6 on Flexconnect AP	8.4	8.4	8.4
VLAN Based Central Switching	No	No	No
aWIPS	MSE 8.0	MSE 8.0	MSE 8.0
Rogue detection and Mitigation	Yes	Yes	Yes
RLDP	No	No	No
CCKM Fast Roaming	Yes	Yes	Yes
802.11r	Yes	Yes	Yes
Adaptive 11r	8.3 MR1	8.3 MR1	8.3 MR1
OKC	Yes	Yes	Yes
AAAOverride–ACL, VLAN	Yes	Yes	Yes
AAA Override–QoS	8.4	8.4	8.4
AAA Override of AVC Profile	No	No	No
AAA Override Bandwidth contract	No	No	No
VLAN ACL	Yes	Yes	Yes
DNS ACL	Yes	Yes	Yes
L2 ACL	Yes	Yes	Yes
Limit Clients per WLAN/Radio	No	No	No
Netflow	No	No	No
WGB Client	No	No	No
Split Tunnelling	No	No	No
Passive Clients	No	No	No
Client exclusion	Yes	Yes	Yes
MFP	No	No	No
TrustSec SXP/SGT	No	No	No
QoS Markings DSCP/dot1p Markings	Yes	Yes	Yes
CleanAir	n/a	Yes	Yes
Native VLAN and VLAN Support on FlexConnect Group	Yes	Yes	Yes
AVC Policy	Yes	Yes	Yes
Proxy ARP	8.4	8.4	8.4
Syslog (no support for facility setting)	Yes	Yes	Yes
ClientLink	TxBF	Yes	Yes
Load Balancing	Yes	Yes	Yes
Band Select	Yes	Yes	Yes
Smart AP Image Upgrade	Yes	Yes	Yes
Default Flex Group	Yes	Yes	Yes
NAT/PAT	8.4	8.4	8.4
Ethernet fallback	No	No	No
PPPoE client	No	No	No
Bidirectional rate limiting Flex	No	No	No
Peer to Peer Blocking	No	No	No
802.11w	No	No	No
BYOD, NAC RADIUS, CWA Flex Central Auth	No	No	No
BYOD, NAC RADIUS, CWA Local Auth	No	No	No
MAC Authentication Flex Central Auth	Yes	Yes	Yes
MAC Authentication Flex Local Auth	No	No	No
GTK Randomization	No	No	No
Videostream	No	No	No
Data DTLS Encryption	Yes	Yes	Yes

Note	This matrix is updated up to AireOS software release 8.4.

source: http://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-3/b_feature_matrix_for_802_11ac_wave2_access_points.html

802.11ah - HaLow

2017-04-19T16:03:09.824000Z

A quick overview on 11ah

Spectrum for 11ah

Potential 11ah devices

Note: This is for educational purposes

source: http://www.comsocscv.org/docs/IEEE%20ComSoc_11ah_Opportunity_V6_0715.pdf

Lowe's In-Store Navigation Sneak Peak

2017-03-23T20:22:33.871000Z

A quick video showing the power of in store navigation and location tracking which is going to change the shape of retail and other verticals.

Cisco Spark Board

2017-01-25T17:28:10.616000Z

With the Cisco Spark Board, you can wirelessly present, white board, and video or audio conference – everything you need for team collaboration, all at the touch of a finger. And you can use the Cisco Spark app to connect to your virtual teams outside the physical room, through the devices of your choice.

Designed with you in mind

Enjoy an easy-to-use, touch-based, high-quality collaboration experience on Cisco Spark Board, which integrates the most common tools needed for team collaboration in physical meeting rooms into a single, elegant device.

Connect with your virtual teams through Cisco Spark app

Everything created on the Cisco Spark Board can be stored in the cloud and associated with a virtual room. Using the Cisco Spark app, team members can pick up wherever they left off in the physical room, and continue working wherever they want.

Intelligently anticipates your needs

The Cisco Spark Board automatically wakes up when you enter the room, detects your Cisco Spark app-supported device, and suggests an activity to choose from, such as call, white board or wirelessly share your presentation. The app also gives you basic control of the Cisco Spark Board through your mobile device.

Intelligent camera delivers a natural viewing experience

Our powerful 4K camera captures a high-resolution, wide-angle image of virtually the entire room. Dynamic framing gives you the best possible view of people in the room.

Intelligent microphones create crisp, clear audio

A 12-microphone array automatically amplifies and modulates speaker voices so meeting participants sound great, even those at the far end of the room. Built-in microphones keep tables clear of wires.

source: https://www.ciscospark.com/products/spark-board.html

802.11 MAC Architecture (Video)

2017-01-16T15:48:03.259000Z

A quick overview video on 802.11 MAC architecture

Example of AP containment

2017-01-14T01:46:09.353000Z

He all,

This is a quick example showing AP containment. The problem statement was the clients were not able to connect to this single AP on a specific SSID. During the course of debugging the issue, the AP was replaced and still the problem persisted. Upon further investigation it turned out that neighbor’s AP were containing our production AP.

The debugs showed the client abandoning the EAP process and associating and re-associating back to the same AP and failing again during the EAP handshake.

*Dot1x_NW_MsgTask_1: Jan 12 16:52:45.154: f4:5c:89:be:14:a9 Processing Access-Challenge for mobile f4:5c:89:be:14:a9

*Dot1x_NW_MsgTask_1: Jan 12 16:52:45.154: f4:5c:89:be:14:a9 Entering Backend Auth Req state (id=37) for mobile f4:5c:89:be:14:a9

*Dot1x_NW_MsgTask_1: Jan 12 16:52:45.154: f4:5c:89:be:14:a9 Sending EAP Request from AAA to mobile f4:5c:89:be:14:a9 (EAP Id 37)

*Dot1x_NW_MsgTask_1: Jan 12 16:52:45.154: f4:5c:89:be:14:a9 Reusing allocated memory for EAP Pkt for retransmission to mobile f4:5c:89:be:14:a9

…………………...

*apfMsConnTask_7: Jan 12 16:52:51.225: f4:5c:89:be:14:a9 Processing assoc-req station:f4:5c:89:be:14:a9 AP:a0:ec:f9:d8:fa:20-01 thread:15147690

*apfMsConnTask_7: Jan 12 16:52:51.226: f4:5c:89:be:14:a9 Reassociation received from mobile on BSSID a0:ec:f9:d8:fa:20 AP wlsn01-41-cap6

The above cycle would keep repeating over and over

If you see the below screenshot the arrows show the deauthentication frames sent out to broadcast address. Pay close attention to the RSSI of the frame which is -70dBm

Look at the highlighted frame now and check the RSSI (-49 dBm). This is a regular frame from the production AP.

I selected the deauth frames in the capture and 14.5% of the total frames were deauth frames.

This was a tricky issue and not commonly seen out in the field.

Note: The data shared above is only meant for educational purposes

Show Controllers Dot11Radio 1 Output for Cisco AP 3802

2016-12-15T15:39:54.121000Z

3800#show controllers dot11Radio 1

wifi1 Link encap:Ethernet HWaddr 00:F6:63:72:AF:D0

UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1

RX packets:7886405 errors:0 dropped:35 overruns:0 frame:0

TX packets:870360 errors:0 dropped:0 overruns:0 carrier:0

collisions:0 txqueuelen:1000

RX bytes:3996130216 (3.7 GiB) TX bytes:791842673 (755.1 MiB)

Interrupt:102 Memory:f8400000-f8600000

Radio Info Summary:

=======================

Radio: 5.0GHz

Carrier Set: (-B) United States ( US )

Base radio MAC: 00:F6:63:72:AF:D0

Supported Channels:

36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 144 149 153 157 161 165

Configured Frequency: 5180MHz Channel:36 80MHz

Number of Transmit Antennas: 4

Configured Antenna Gain(dB): 5

Legal Antenna Gain in use(dB): 5

Configured Level: 1

Configured TxPower(dBm): 22

Total Supported Power Levels:8

Allowed total powers(dBm):

22 19 16 13 10 7 4 2

Allowed per-path powers(dBm):

16 13 10 7 4 1 -2 -4

Frequency List:

====================

Configured Frequency: 5180Mhz Channel: 36

Serving Frequency: 5180Mhz Channel: 36

Allowed Frequency: 5180Mhz(36) 5200Mhz(40) 5220Mhz(44) 5240Mhz(48) 5260Mhz(52) 5280Mhz(56) 5300Mhz(60) 5320Mhz(64) 5500Mhz(100) 5520Mhz(104) 5540Mhz(108) 5560Mhz(112) 5580Mhz(116) 5600Mhz(120) 5620Mhz(124) 5640Mhz(128) 5660Mhz(132) 5680Mhz(136) 5700Mhz(140) 5720Mhz(144) 5745Mhz(149) 5765Mhz(153) 5785Mhz(157) 5805Mhz(161) 5825Mhz(165)

Antenna config:

====================

Antenna: RX [ a b c d ]

TX [ a b c d ]

Internal

Antenna Gain: 1. 5dBm 2. 5dBm 3. 5dBm 4. 5dBm

Rate Config:

====================

Legacy Rates(Mbps): 12 18 24 36 48 54

HT Rates(MCS):M0 M1 M2 M3 M4 M5 M6 M7 M8 M9 M10 M11 M12 M13 M14 M15 M16 M17 M18 M19 M20 M21 M22 M23

VHT Rates: 1SS:M0-9 2SS:M0-9 3SS:M0-9 4SS:NONE

EDCA Config:

====================

L:Local EDCA params C:Cell EDCA params

AC Type CwMin CwMax Aifs Txop ACM

AC_BE L 4 6 3 0 0

AC_BK L 4 10 7 0 0

AC_VI L 3 4 1 94 0

AC_VO L 2 3 1 47 0

AC_BE C 4 10 3 0 0

AC_BK C 4 10 7 0 0

AC_VI C 3 4 2 94 0

AC_VO C 2 3 2 47 0

MAC Config

====================

Beacon Interval: 100

RxSOP Sensitivity: 0

Macro Micro Steering Cfg

====================

ANTENNA_TYPE : INT

OPMODE : Disabled

PROBE_VALIDITY_TIME(sec) : 100

SUPPRESS_RSSI_THRESH : 55

ENABLE_RSSI_THRESH : 61

PROBE_AGGR_WINDOW(msec) : 200

SUPPRESS_COUNT(#cycles) : 3

Sniffer Cfg

====================

NOT A SNIFFER MODE AP

Associated client list:

====================

Total Client Count:2

Radio Total_clients Legacy_clients HT/VHT20_clients HT/VHT40_clients VHT80_clients

0 0 0 0 0 0

1 2 0 0 0 2

mac radio vap aid state encr Maxrate is_wgb_wired wgb_mac_addr

4C:34:88:3D:CB:24 1 0 2 FWD AES_CCM128 MCS92SS false 00:00:00:00:00:00

6C:40:08:9D:A9:12 1 0 3 FWD AES_CCM128 MCS93SS false 00:00:00:00:00:00

WLANs and stats:

====================

radio wlan id mac ssid state

1 0 00:F6:63:72:AF:DF Rattlesnake UP

intf TxData TxUC TxMBC TxBytes TxFail TxDcrd RxData RxUC RxMBC RxBytes RxErr UCTxRt MCTxRt stats_ago

apr1v0 0 0 0 0 0 0 0 0 0 0 0 0 0 5.134000

Vlan Summary:

====================

Vlan BSSID Pri/U/M EncryPolicy Key0 Key1 Key2 Key3 iGTK SSIDs MFP

1 AFDF 6 6 6 AES x128 DIS Rattlesnake 0

radio stats:

====================

show per rate stats:

RATE 6.0

Rx Packets: 192 / 0 Tx Packets: 0 / 0

Rx Bytes: 7547 / 0 Tx Bytes: 0 / 0

RTS Retries: 0 / 0 Data Retries: 0 / 0

RATE 12.0

Rx Packets: 38057 / 11 Tx Packets: 74531 / 2

Rx Bytes: 81673 / 0 Tx Bytes: 8202737 / 360

RTS Retries: 0 / 0 Data Retries: 180368 / 0

RATE 18.0

Rx Packets: 38 / 0 Tx Packets: 0 / 0

Rx Bytes: 13750 / 0 Tx Bytes: 0 / 0

RTS Retries: 0 / 0 Data Retries: 0 / 0

RATE 24.0

Rx Packets: 41 / 0 Tx Packets: 0 / 0

Rx Bytes: 19769 / 0 Tx Bytes: 0 / 0

RTS Retries: 0 / 0 Data Retries: 0 / 0

RATE 36.0

Rx Packets: 40 / 0 Tx Packets: 0 / 0

Rx Bytes: 16903 / 0 Tx Bytes: 0 / 0

RTS Retries: 0 / 0 Data Retries: 0 / 0

RATE 48.0

Rx Packets: 65 / 0 Tx Packets: 0 / 0

Rx Bytes: 22218 / 0 Tx Bytes: 0 / 0

RTS Retries: 0 / 0 Data Retries: 0 / 0

RATE 54.0

Rx Packets: 108 / 0 Tx Packets: 0 / 0

Rx Bytes: 26440 / 0 Tx Bytes: 0 / 0

RTS Retries: 0 / 0 Data Retries: 0 / 0

RATE m0-2s

Rx Packets: 5274 / 0 Tx Packets: 0 / 0

Rx Bytes: 1274910 / 0 Tx Bytes: 0 / 0

RTS Retries: 0 / 0 Data Retries: 0 / 0

RATE m1-2s

Rx Packets: 12112 / 0 Tx Packets: 49021 / 0

Rx Bytes: 5133680 / 0 Tx Bytes: 5352560 / 0

RTS Retries: 0 / 0 Data Retries: 12870 / 0

RATE m2-4s

Rx Packets: 205451 / 0 Tx Packets: 6061 / 0

Rx Bytes: 43968009 / 0 Tx Bytes: 674957 / 0

RTS Retries: 0 / 0 Data Retries: 2284 / 0

RATE m3-2s

Rx Packets: 66728 / 0 Tx Packets: 376 / 0

Rx Bytes: 14272547 / 0 Tx Bytes: 84412 / 0

RTS Retries: 0 / 0 Data Retries: 157 / 0

RATE m4-4s

Rx Packets: 7156 / 0 Tx Packets: 374 / 0

Rx Bytes: 1294473 / 0 Tx Bytes: 171921 / 0

RTS Retries: 0 / 0 Data Retries: 185 / 0

RATE m5-2s

Rx Packets: 0 / 0 Tx Packets: 783 / 0

Rx Bytes: 0 / 0 Tx Bytes: 337386 / 0

RTS Retries: 0 / 0 Data Retries: 161 / 0

RATE m6-2s

Rx Packets: 0 / 0 Tx Packets: 357 / 0

Rx Bytes: 0 / 0 Tx Bytes: 81013 / 0

RTS Retries: 0 / 0 Data Retries: 61 / 0

RATE m7t4s

Rx Packets: 1907 / 0 Tx Packets: 518 / 0

Rx Bytes: 249435 / 0 Tx Bytes: 175380 / 0

RTS Retries: 0 / 0 Data Retries: 27 / 0

RATE a0.1-2s

Rx Packets: 73 / 0 Tx Packets: 109 / 0

Rx Bytes: 5968 / 0 Tx Bytes: 151860 / 0

RTS Retries: 0 / 0 Data Retries: 1970 / 0

RATE a1.1-4s

Rx Packets: 0 / 0 Tx Packets: 100 / 0

Rx Bytes: 0 / 0 Tx Bytes: 65132 / 0

RTS Retries: 0 / 0 Data Retries: 1146 / 0

RATE a2.1b4s

Rx Packets: 4 / 0 Tx Packets: 5900 / 0

Rx Bytes: 195 / 0 Tx Bytes: 7477352 / 0

RTS Retries: 0 / 0 Data Retries: 2234 / 0

RATE a3.1t8s

Rx Packets: 143 / 0 Tx Packets: 1 / 0

Rx Bytes: 13454 / 0 Tx Bytes: 112 / 0

RTS Retries: 0 / 0 Data Retries: 4 / 0

RATE a4.1-8s

Rx Packets: 42 / 0 Tx Packets: 10 / 0

Rx Bytes: 5314 / 0 Tx Bytes: 2480 / 0

RTS Retries: 0 / 0 Data Retries: 111 / 0

RATE a5.1-8s

Rx Packets: 42 / 0 Tx Packets: 0 / 0

Rx Bytes: 6631 / 0 Tx Bytes: 0 / 0

RTS Retries: 0 / 0 Data Retries: 0 / 0

RATE a6.1-8s

Rx Packets: 70 / 0 Tx Packets: 0 / 0

Rx Bytes: 20513 / 0 Tx Bytes: 0 / 0

RTS Retries: 0 / 0 Data Retries: 0 / 0

RATE a7.1-8s

Rx Packets: 455 / 0 Tx Packets: 0 / 0

Rx Bytes: 114148 / 0 Tx Bytes: 0 / 0

RTS Retries: 0 / 0 Data Retries: 0 / 0

RATE a8.1t8s

Rx Packets: 488 / 0 Tx Packets: 0 / 0

Rx Bytes: 110413 / 0 Tx Bytes: 0 / 0

RTS Retries: 0 / 0 Data Retries: 0 / 0

RATE a9.1-8s

Rx Packets: 356 / 0 Tx Packets: 0 / 0

Rx Bytes: 54799 / 0 Tx Bytes: 0 / 0

RTS Retries: 0 / 0 Data Retries: 0 / 0

Video Transmission Metrics:

====================

Media Direct Band Configuration

Unicast Video Redirect = false

Client Min Phy Rate = 0

Max Retry Percentage = 90

Dot11 Current Video Transmission Metrics:

Arrivals:0 Q-Drops:0 Tries:0 Agg:0 Success:0 Fail:0

Dot11 5-second Video Transmission Metrics:

Arrivals:0 Tries:0 Agg:0 Success:0 Fail:0

Radio-Q-Peak:0 Video-Q-Peak:0 Video-Q-Drops:0

Delay - Tot Msec:0 10/20/40/40+ Msec:0/0/0/0

Dot11 1-second Video Transmission Metrics:

Q-util:0 max-tx-time:0 p-chan:0 p-video:0 L/r:0

Radio RC stats:

====================

Total count: 0

QBSS Load: cca_load: 0x8, rx_load: 0x0, tx_load: 0x1

Cisco Wireless Best Practices Flexible Radio Assignment (FRA)

2016-12-05T16:11:11.185000Z

Cisco Dual 5GHz Wi-Fi

2016-12-05T16:08:11.436000Z

TechWiseTV: Mobility Beyond Wave 2

2016-11-09T00:56:25.173000Z

Cisco WLC 8.3 Adaptive 11r

2016-10-17T16:31:19.661000Z

Adaptive 11r

On the Cisco Infrastructure side, Cisco AP will advertise the support for adaptive 802.11r in beacons and probes, and FT over the DS capability will be set.

On the client side, devices running iOS 10 or higher will look for the adaptive 11r feature support in the IE. If the capability bit is set, it will look for AKM (dot1x or PSK) and use FT dot1x or FT PSK respectively. The Apple device will send IE with FT support in its association request and also include the Vendor specific OUI.

Cisco WLAN will process the association request and respond with 802.11r support in association response, allowing FT association. The 4-Way handshake will involve FT Association.

This feature is supported on Local mode as well as FlexConnect mode APs, for all 802.11n and 802.11ac wave 1 APs controlled by a WLC running AireOS release 8.32.

Legacy devices that do not recognize the FT AKM’s beacons and probe responses will not be able to join the WLAN. We need a way to identify the Client device capability and allow 11r capable device to join on the WLAN as an FT enabled device and at the same time to allow legacy device to join as an 11i/WPA2 device. Cisco WLC Software release 8.3 will enable 802.11r on an 802.11i-enabled WLAN selectively for Apple devices1. The capable Apple devices will identify this functionality and perform an FT Association on the WLAN.

Configurations Steps

Create a new WLAN (SSID) with PSK Layer 2 authentication (802.1x is also supported). The Adaptive 11r Feature is enabled by default. Over the DS is selected by default and re-association timeout is set to 20 seconds.

Note: When upgrading from a previous release, the Adaptive 11r feature will be disabled by default for an existing WLAN.

This can be changed using the GUI or the CLI command:

- config wlan security ft adaptive enable/disable

Enable AKM as 802.1x or PSK instead of FT 802.1x or FT PSK.

Enable the WLAN and associate three different clients to the SSID
- - iPad and iPhone devices running iOS 10 or higher
  - iPad and iPhone devices running iOS 9 or lower
  - Non-iOS device

Verify that
- - iPad or iPhone running iOS 10 or higher associates as a 11r client
  - iPad or iPhone running iOS 9 or lower associates as a regular 802.11i client
  - Non-Apple device associates as a regular 802.11i client

Verify that
- - iPad or iPhone running iOS 10 or higher fast roams to a new AP
  - iPad or iPhone running iOS 9 or lower slow roams to a new AP

Additional Guidelines for Configuration

1. Configure 802.1x or PSK as AKM instead of the FT variants

CLI Commands:

config wlan security wpa akm 802.1x enable or
config wlan security wpa akm psk enable

Enable/Disable FT over the ds and set re-assoc timeout, if required

CLI Commands:

config wlan security ft over-the-ds enable/disable
config wlan security ft reassociation-timeout

For more: http://www.cisco.com/c/dam/en/us/td/docs/wireless/controller/technotes/8-3/Optimizing_WiFi_Connectivity_and_Prioritizing_Business_Apps.pdf

Cisco WiSM2 End-of-Sale, End-of-Life

2016-10-17T15:57:37.180000Z

reference: http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/wireless-services-module-2-wism2/eos-eol-notice-c51-738008.html

iPhone 7 802.11r debugs on Cisco

2016-09-27T14:15:32.860000Z

sample debugs

AP 3700 base radio mac - f4:0f:1b:99:4f:20
AP 3600 base radio mac - 3c:ce:73:39:40:90

(Cisco Controller) >debug client f4:0f:24:89:50:df

(Cisco Controller) >debug ft ?

events Configures debug of 802.11r events

(Cisco Controller) >debug ft events ?

disable Disables debug.
enable Enables debug.

(Cisco Controller) >debug ft events enable

(Cisco Controller) >*apfMsConnTask_6: Sep 22 21:25:09.566: f4:0f:24:89:50:df Updating 11r vendor IE

*pemReceiveTask: Sep 22 21:25:09.578: f4:0f:24:89:50:df 192.168.128.43 Removed NPU entry.
*spamApTask0: Sep 22 21:25:09.578: f4:0f:24:89:50:df Successful transmission of LWAPP Add-Mobile to AP f4:0f:1b:99:4f:20
*apfMsConnTask_6: Sep 22 21:25:09.579: f4:0f:24:89:50:df Got action frame from this client.
*apfMsConnTask_6: Sep 22 21:25:09.579: f4:0f:24:89:50:df Station: F4:0F:24:89:50:DF sent 802.11K neighbor request to AP F4:0F:1B:99:4F:20
*apfMsConnTask_6: Sep 22 21:25:09.579: f4:0f:24:89:50:df Station: F4:0F:24:89:50:DF requested neighbors on non XOR roam capable AP F4:0F:1B:99:4F:20 Slot 1
*apfMsConnTask_6: Sep 22 21:25:09.579: Ms with adaptive capability found

*spamApTask0: Sep 22 21:25:09.580: f4:0f:24:89:50:df Received ADD_MOBILE ack - Initiating 1x to STA f4:0f:24:89:50:df (idx 22)
*spamApTask0: Sep 22 21:25:09.580: f4:0f:24:89:50:df Sent dot1x auth initiate message for mobile f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.580: f4:0f:24:89:50:df reauth_sm state transition 1 ---> 0 for mobile f4:0f:24:89:50:df at 1x_reauth_sm.c:53
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.580: f4:0f:24:89:50:df Creating a PKC PMKID Cache entry for station f4:0f:24:89:50:df (RSN 2)
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.580: f4:0f:24:89:50:df Resetting MSCB PMK Cache Entry 0 for station f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.580: f4:0f:24:89:50:df Removing BSSID f4:0f:1b:99:4f:2f from PMKID cache of station f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.580: f4:0f:24:89:50:df Setting active key cache index 0 ---> 8
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.580: f4:0f:24:89:50:df Setting active key cache index 8 ---> 0
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.580: f4:0f:24:89:50:df Adding BSSID f4:0f:1b:99:4f:2f to PMKID cache at index 0 for station f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.580: New PMKID: (16)

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: [0000] e7 ba d7 7a 0d d8 69 30 1b 66 ec c4 da 79 aa 54

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df Creating global PMK cache for this TGr client
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df Skipping cache delete as AP will get cache update.
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df Created PMK Cache Entry for TGr AKM:PSK f4:0f:24:89:50:df

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df R0KH-ID:192.168.128.250 R1KH-ID:50:06:04:ca:da:60 MSK Len:48
pmkValidTime:86400

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df Adding Audit session ID payload in Mobility handoff

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df 0 PMK-update groupcast messages sent
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df Initiating RSN PSK to mobile f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df EAP-PARAM Debug - eap-params for Wlan-Id :1 is disabled - applying Global eap timers and retries
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df Disable re-auth, use PMK lifetime.
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df dot1x - moving mobile f4:0f:24:89:50:df into Force Auth state
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df Skipping EAP-Success to mobile f4:0f:24:89:50:df (encryptBit:0)
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df key Desc Version FT - 1

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df Found an cache entry for BSSID f4:0f:1b:99:4f:2f in PMKID cache at index 0 of station f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df Found an cache entry for BSSID f4:0f:1b:99:4f:2f in PMKID cache at index 0 of station f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: Including PMKID in M1 (16)

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: [0000] e7 ba d7 7a 0d d8 69 30 1b 66 ec c4 da 79 aa 54

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: M1 - Key Data: (22)

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: [0000] dd 14 00 0f ac 04 e7 ba d7 7a 0d d8 69 30 1b 66

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: [0016] ec c4 da 79 aa 54

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df Starting key exchange to mobile f4:0f:24:89:50:df, data packets will be dropped
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df Sending EAPOL-Key Message to mobile f4:0f:24:89:50:df
state INITPMK (message 1), replay counter 00.00.00.00.00.00.00.00
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.581: f4:0f:24:89:50:df Allocating EAP Pkt for retransmission to mobile f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.587: f4:0f:24:89:50:df Received EAPOL-Key from mobile f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.587: f4:0f:24:89:50:df key Desc Version FT - 1

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.587: f4:0f:24:89:50:df Received EAPOL-key in PTK_START state (message 2) from mobile f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.587: f4:0f:24:89:50:df Encryption Policy: 4, PTK Key Length: 48
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.588: 00000000: 30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 0...............
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.588: 00000010: 00 0f ac 04 0c 00 ......
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.588: 00000000: 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ................
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.588: 00000010: ac 04 0c 00 01 00 6c 30 5a 4d d4 3b 29 ff ac 6e ......l0ZM.;)..n
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.588: 00000020: 42 ff 1c 72 1b bc B..r..
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.588: f4:0f:24:89:50:df Calculating PMKR0Name
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.588: f4:0f:24:89:50:df Not Flex client. Do not distribute dot11r Key cache.
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.588: f4:0f:24:89:50:df Stopping retransmission timer for mobile f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.588: f4:0f:24:89:50:df key Desc Version FT - 1

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.588: f4:0f:24:89:50:df key Desc Version FT - 1

*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.588: f4:0f:24:89:50:df Sending EAPOL-Key Message to mobile f4:0f:24:89:50:df
state PTKINITNEGOTIATING (message 3), replay counter 00.00.00.00.00.00.00.01
*Dot1x_NW_MsgTask_7: Sep 22 21:25:09.588: f4:0f:24:89:50:df Reusing allocated memory for EAP Pkt for retransmission to mobile f4:0f:24:89:50:df
*DHCP Socket Task: Sep 22 21:25:09.657: f4:0f:24:89:50:df DHCP received op BOOTREQUEST (1) (len 308,vlan 0, port 4, encap 0xec03, xid 0xf9a6976c)
*DHCP Socket Task: Sep 22 21:25:09.657: f4:0f:24:89:50:df DHCP (encap type 0xec03) mstype 0ff:ff:ff:ff:ff:ff
*DHCP Socket Task: Sep 22 21:25:09.657: f4:0f:24:89:50:df DHCP processing DHCP REQUEST (3)
*DHCP Socket Task: Sep 22 21:25:09.657: f4:0f:24:89:50:df DHCP op: BOOTREQUEST, htype: Ethernet, hlen: 6, hops: 0
*DHCP Socket Task: Sep 22 21:25:09.657: f4:0f:24:89:50:df DHCP xid: 0xf9a6976c (4188444524), secs: 0, flags: 0
*DHCP Socket Task: Sep 22 21:25:09.657: f4:0f:24:89:50:df DHCP chaddr: f4:0f:24:89:50:df
*DHCP Socket Task: Sep 22 21:25:09.657: f4:0f:24:89:50:df DHCP ciaddr: 0.0.0.0, yiaddr: 0.0.0.0
*DHCP Socket Task: Sep 22 21:25:09.657: f4:0f:24:89:50:df DHCP siaddr: 0.0.0.0, giaddr: 0.0.0.0
*DHCP Socket Task: Sep 22 21:25:09.657: f4:0f:24:89:50:df DHCP requested ip: 192.168.128.43
*DHCP Socket Task: Sep 22 21:25:09.657: f4:0f:24:89:50:df DHCP Opt82 bridge mode insertion enabled, inserts opt82 if opt82 is enabled vlan=0, datalen =14, optlen=64
*DHCP Socket Task: Sep 22 21:25:09.657: f4:0f:24:89:50:df DHCP successfully bridged packet to DS
*DHCP Socket Task: Sep 22 21:25:09.660: f4:0f:24:89:50:df DHCP received op BOOTREPLY (2) (len 308,vlan 0, port 1, encap 0xec00, xid 0xf9a6976c)
*DHCP Socket Task: Sep 22 21:25:09.660: f4:0f:24:89:50:df DHCP processing DHCP ACK (5)
*DHCP Socket Task: Sep 22 21:25:09.660: f4:0f:24:89:50:df DHCP op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 0
*DHCP Socket Task: Sep 22 21:25:09.660: f4:0f:24:89:50:df DHCP xid: 0xf9a6976c (4188444524), secs: 0, flags: 0
*DHCP Socket Task: Sep 22 21:25:09.660: f4:0f:24:89:50:df DHCP chaddr: f4:0f:24:89:50:df
*DHCP Socket Task: Sep 22 21:25:09.660: f4:0f:24:89:50:df DHCP ciaddr: 0.0.0.0, yiaddr: 192.168.128.43
*DHCP Socket Task: Sep 22 21:25:09.660: f4:0f:24:89:50:df DHCP siaddr: 0.0.0.0, giaddr: 0.0.0.0
*DHCP Socket Task: Sep 22 21:25:09.660: f4:0f:24:89:50:df DHCP server id: 192.168.128.1 rcvd server id: 192.168.128.1
*DHCP Socket Task: Sep 22 21:25:09.660: f4:0f:24:89:50:df DHCP successfully bridged packet to STA

roam from 3700 to 3600

(Cisco Controller) >
(Cisco Controller) >*apfMsConnTask_6: Sep 22 21:26:04.520: f4:0f:24:89:50:df Got action frame from this client.
*apfMsConnTask_6: Sep 22 21:26:04.520: f4:0f:24:89:50:df Doing preauth for this client over the DS
*apfMsConnTask_6: Sep 22 21:26:04.520: f4:0f:24:89:50:df Doing local roaming for destination address f4:0f:1b:99:4f:2f
*apfMsConnTask_6: Sep 22 21:26:04.520: f4:0f:24:89:50:df Got 1 AKMs in RSNIE
*apfMsConnTask_6: Sep 22 21:26:04.520: f4:0f:24:89:50:df RSNIE AKM matches with PMK cache entry :0x4
*apfMsConnTask_6: Sep 22 21:26:04.521: f4:0f:24:89:50:df pmkRoName derived sucessfully
*apfMsConnTask_6: Sep 22 21:26:04.521: f4:0f:24:89:50:df Validate FTIE for R0KH-ID, Store SNonce passed
*apfMsConnTask_6: Sep 22 21:26:04.521: f4:0f:24:89:50:df Created a new preauth entry for AP:3c:ce:73:39:40:9f
*apfMsConnTask_6: Sep 22 21:26:04.521: f4:0f:24:89:50:df FT Auth Resp: Setting adaptive AKM 4 into RSN Data at 19

*apfMsConnTask_0: Sep 22 21:26:04.557: f4:0f:24:89:50:df Updating 11r vendor IE

*apfMsConnTask_0: Sep 22 21:26:04.557: f4:0f:24:89:50:df Processing assoc-req station:f4:0f:24:89:50:df AP:3c:ce:73:39:40:90-01 thread:1a8cf910
*apfMsConnTask_0: Sep 22 21:26:04.557: f4:0f:24:89:50:df Station: F4:0F:24:89:50:DF trying to join WLAN with RSSI 232. Checking for XOR roam conditions on AP: 3C:CE:73:39:40:90 Slot: 1
*apfMsConnTask_0: Sep 22 21:26:04.557: f4:0f:24:89:50:df Station: F4:0F:24:89:50:DF is associating to AP 3C:CE:73:39:40:90 which is not XOR roam capable
*apfMsConnTask_0: Sep 22 21:26:04.557: f4:0f:24:89:50:df Reassociation received from mobile on BSSID 3c:ce:73:39:40:9f AP Viten_3600_1
*apfMsConnTask_0: Sep 22 21:26:04.557: f4:0f:24:89:50:df Station: F4:0F:24:89:50:DF trying to join WLAN with RSSI 232. Checking for XOR roam conditions on AP: 3C:CE:73:39:40:90 Slot: 1
*apfMsConnTask_0: Sep 22 21:26:04.557: f4:0f:24:89:50:df Station: F4:0F:24:89:50:DF is associating to AP 3C:CE:73:39:40:90 which is not XOR roam capable
*apfMsConnTask_0: Sep 22 21:26:04.557: f4:0f:24:89:50:df Global 200 Clients are allowed to AP radio

*apfMsConnTask_0: Sep 22 21:26:04.557: f4:0f:24:89:50:df Max Client Trap Threshold: 0 cur: 3

*apfMsConnTask_0: Sep 22 21:26:04.557: f4:0f:24:89:50:df Rf profile 600 Clients are allowed to AP wlan

*apfMsConnTask_0: Sep 22 21:26:04.557: f4:0f:24:89:50:df FT Adaptive AKM not negotiated
*apfMsConnTask_0: Sep 22 21:26:04.557: f4:0f:24:89:50:df override for default ap group, marking intgrp NULL
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df Applying Interface(management) policy on Mobile, role Local. Ms NAC State 2 Quarantine Vlan 0 Access Vlan 0

*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df Re-applying interface policy for client

*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df 192.168.128.43 RUN (20) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2931)
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df 192.168.128.43 RUN (20) Changing Url ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2951)
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df 192.168.128.43 RUN (20) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2972)
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df apfApplyWlanPolicy: Apply WLAN Policy over PMIPv6 Client Mobility Type, Tunnel User - 0
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df In processSsidIE:6444 setting Central switched to TRUE
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df In processSsidIE:6447 apVapId = 1 and Split Acl Id = 65535
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df Applying site-specific Local Bridging override for station f4:0f:24:89:50:df - vapId 1, site 'default-group', interface 'management'
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df Applying Local Bridging Interface Policy for station f4:0f:24:89:50:df - vlan 0, interface id 0, interface 'management'
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df processSsidIE statusCode is 0 and status is 0
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df processSsidIE ssid_done_flag is 0 finish_flag is 0
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df STA - rates (4): 176 72 96 108 0 0 0 0 0 0 0 0 0 0 0 0
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df suppRates statusCode is 0 and gotSuppRatesElement is 1
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df Marking this mobile as TGr capable.
*apfMsConnTask_0: Sep 22 21:26:04.558: RSNIE in Assoc. Req.: (38)

*apfMsConnTask_0: Sep 22 21:26:04.558: [0000] 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f

*apfMsConnTask_0: Sep 22 21:26:04.558: [0016] ac 04 0c 00 01 00 6c 30 5a 4d d4 3b 29 ff ac 6e

*apfMsConnTask_0: Sep 22 21:26:04.558: [0032] 42 ff 1c 72 1b bc

*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df Processing RSN IE type 48, length 38 for mobile f4:0f:24:89:50:df
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df
ccmp128 is enabled
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df RSN Capabilities: 12
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df Marking Mobile as non-11w Capable
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df Validating FT AKM's on WLAN
*apfMsConnTask_0: Sep 22 21:26:04.558: f4:0f:24:89:50:df Setting adaptive AKM 4 into RSN Data at 19

*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df Roaming succeed for this client.
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df pemApfDeleteMobileStation2: APF_MS_PEM_WAIT_L2_AUTH_COMPLETE = 0.
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df 192.168.128.43 RUN (20) Deleted mobile LWAPP rule on AP [f4:0f:1b:99:4f:20]
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df Updated location for station old AP f4:0f:1b:99:4f:20-1, new AP 3c:ce:73:39:40:90-1
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df apfMsRunStateDec
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df apfMs1xStateDec
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df 192.168.128.43 RUN (20) Change state to START (0) last state RUN (20)

*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df pemApfAddMobileStation2: APF_MS_PEM_WAIT_L2_AUTH_COMPLETE = 0.
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df 192.168.128.43 START (0) Initializing policy
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df 192.168.128.43 START (0) Change state to AUTHCHECK (2) last state START (0)

*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df 192.168.128.43 AUTHCHECK (2) Change state to 8021X_REQD (3) last state AUTHCHECK (2)

*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df Encryption policy is set to 0x80000004
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df Not Using WMM Compliance code qosCap 00
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df 192.168.128.43 8021X_REQD (3) Plumbed mobile LWAPP rule on AP 3c:ce:73:39:40:90 vapId 1 apVapId 1 flex-acl-name:
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df apfPemAddUser2 (apf_policy.c:437) Changing state for mobile f4:0f:24:89:50:df on AP 3c:ce:73:39:40:90 from Associated to Associated

*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df apfPemAddUser2:session timeout forstation f4:0f:24:89:50:df - Session Tout 0, apfMsTimeOut '0' and sessionTimerRunning flag is 0
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df Stopping deletion of Mobile Station: (callerId: 48)
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df Func: apfPemAddUser2, Ms Timeout = 0, Session Timeout = 0

*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df Sending assoc-resp with status 0 station:f4:0f:24:89:50:df AP:3c:ce:73:39:40:90-01 on apVapId 1
*apfMsConnTask_0: Sep 22 21:26:04.559: f4:0f:24:89:50:df Including FT Mobility Domain IE (length 5) in reassociation assoc Resp to mobile
*apfMsConnTask_0: Sep 22 21:26:04.560: f4:0f:24:89:50:df Sending Assoc Response to station on BSSID 3c:ce:73:39:40:9f (status 0) ApVapId 1 Slot 1
*apfMsConnTask_0: Sep 22 21:26:04.560: f4:0f:24:89:50:df apfProcessAssocReq (apf_80211.c:10863) Changing state for mobile f4:0f:24:89:50:df on AP 3c:ce:73:39:40:90 from Associated to Associated

*pemReceiveTask: Sep 22 21:26:04.562: f4:0f:24:89:50:df 192.168.128.43 Removed NPU entry.
*spamApTask0: Sep 22 21:26:04.562: f4:0f:24:89:50:df Delete Mobile request sent to the AP 192.168.128.32:57576

*spamApTask7: Sep 22 21:26:04.563: f4:0f:24:89:50:df Successful transmission of LWAPP Add-Mobile to AP 3c:ce:73:39:40:90
*apfMsConnTask_0: Sep 22 21:26:04.565: f4:0f:24:89:50:df Got action frame from this client.
*apfMsConnTask_0: Sep 22 21:26:04.565: f4:0f:24:89:50:df Station: F4:0F:24:89:50:DF sent 802.11K neighbor request to AP 3C:CE:73:39:40:90
*apfMsConnTask_0: Sep 22 21:26:04.565: f4:0f:24:89:50:df Station: F4:0F:24:89:50:DF requested neighbors on non XOR roam capable AP 3C:CE:73:39:40:90 Slot 1
*apfMsConnTask_0: Sep 22 21:26:04.565: Ms with adaptive capability found

*spamApTask7: Sep 22 21:26:04.567: f4:0f:24:89:50:df Received ADD_MOBILE ack - Initiating 1x to STA f4:0f:24:89:50:df (idx 8)
*spamApTask7: Sep 22 21:26:04.567: f4:0f:24:89:50:df Sent dot1x auth initiate message for mobile f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.567: f4:0f:24:89:50:df reauth_sm state transition 0 ---> 0 for mobile f4:0f:24:89:50:df at 1x_reauth_sm.c:53
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.567: f4:0f:24:89:50:df Finishing FT roaming for mobile f4:0f:24:89:50:df
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.567: f4:0f:24:89:50:df EAP-PARAM Debug - eap-params for Wlan-Id :1 is disabled - applying Global eap timers and retries
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.567: f4:0f:24:89:50:df Disable re-auth, use PMK lifetime.
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.567: f4:0f:24:89:50:df dot1x - moving mobile f4:0f:24:89:50:df into Force Auth state
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.567: f4:0f:24:89:50:df Skipping EAP-Success to mobile f4:0f:24:89:50:df (encryptBit:0)
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.567: f4:0f:24:89:50:df apfMs1xStateInc
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.567: f4:0f:24:89:50:df 192.168.128.43 8021X_REQD (3) Change state to L2AUTHCOMPLETE (4) last state 8021X_REQD (3)

*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.567: f4:0f:24:89:50:df Not Using WMM Compliance code qosCap 00
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.567: f4:0f:24:89:50:df 192.168.128.43 L2AUTHCOMPLETE (4) Plumbed mobile LWAPP rule on AP 3c:ce:73:39:40:90 vapId 1 apVapId 1 flex-acl-name:
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.567: f4:0f:24:89:50:df apfMsRunStateInc
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.567: f4:0f:24:89:50:df 192.168.128.43 L2AUTHCOMPLETE (4) Change state to RUN (20) last state L2AUTHCOMPLETE (4)

roam time approx 21:26:04.567 minus 21:26:04.557 ~ 10ms

*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.568: f4:0f:24:89:50:df 192.168.128.43 RUN (20) Reached PLUMBFASTPATH: from line 6818, null
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.568: f4:0f:24:89:50:df 192.168.128.43 RUN (20) Adding Fast Path rule
type = Airespace AP Client
on AP 3c:ce:73:39:40:90, slot 1, interface = 4, QOS = 2
IPv4 ACL ID = 255, IPv6 ACL ID =
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.568: f4:0f:24:89:50:df 192.168.128.43 RUN (20) Fast Path rule (contd...) 802.1P = 5, DSCP = 0, TokenID = 15206, IntfId = 0 Local Bridging Vlan = 0, Local Bridging intf id = 0
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.568: f4:0f:24:89:50:df 192.168.128.43 RUN (20) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 4, AppToken = 15206 AverageRate = 0, BurstRate = 0

*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.568: f4:0f:24:89:50:df 192.168.128.43 RUN (20) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 4, AppToken = 15206 AverageRate = 0, BurstRate = 0

*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.568: f4:0f:24:89:50:df 192.168.128.43 RUN (20) Fast Path rule (contd...) AVC Ratelimit: AppID = 0 ,AppAction = 4, AppToken = 15206 AverageRate = 0, BurstRate = 0

*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.568: f4:0f:24:89:50:df 192.168.128.43 RUN (20) Successfully plumbed mobile rule (IPv4 ACL ID 255, IPv6 ACL ID 255, L2 ACL ID 255,URL ACL ID 255)
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.568: f4:0f:24:89:50:df 192.168.128.43 RUN (20) No 11v BTM
*Dot1x_NW_MsgTask_7: Sep 22 21:26:04.568: f4:0f:24:89:50:df 192.168.128.43 RUN (20) NO release MSCB
*pemReceiveTask: Sep 22 21:26:04.568: f4:0f:24:89:50:df 192.168.128.43 Added NPU entry of type 1, dtlFlags 0x0

*spamApTask7: Sep 22 21:26:04.569: f4:0f:24:89:50:df Successful transmission of LWAPP Add-Mobile to AP 3c:ce:73:39:40:90

Wireless (Wi-Fi) only network access to users

2016-08-19T14:09:51.537000Z

Hello Everyone,

Below are some high-level factors to consider while thinking of designing a Wireless only access network for end users. What do you think? What did I miss? Have you seen wifi only access network (and no wired ports) out in the field?

Please share your thoughts in the comments section

Cisco WLC 8.3.x Release notes

2016-08-10T13:54:37.834000Z

What’s New in this Release?

Full release notes:

http://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn83.html

Career Guidance Continued..

2016-07-13T15:23:24.649000Z

My previous article was tailored more towards internships, new-grad job opportunities and how can one prep for that journey. In this article i will just list down some of my own viewpoints towards the tech industry (specially the wi-fi world). Don’t quote me on it but this is what I understand from my own career and from others.

If you are aiming to be in a tech job, lets say Wi-Fi, i believe it may prove beneficial to be working for a vendor (Cisco, Aruba etc) than any other company. The reason being - thats where innovation happens and the products are built. Rest all the companies are consumers of those products. Another reason for working with vendor companies is that there are plenty of job profiles in those companies. Let me give an example - (still referring to the Wi-Fi industry here) there are roles like -- Customer support (TAC), Advanced Services (Services), Technical sales (Systems engineer, Consulting Systems Engineer), IT (Internal wifi network of the company), Technical marketing engineer (TME), Product manager (PM) etc.. and then there is the management track for all these roles. All the above roles are for various technologies (wi-fi being one of them). Hypothetically, even if you spend an avg of 2-3 years in each role, you are talking about half your career. This is just to give you an example of whats out there from a job profile standpoint at a vendor. I understand that not everyone would like to change job profiles (for various reasons) and not everyone would like all the above mentioned roles either. Please note that its not that easy to navigate across some of these roles even within the same company.

Changing companies a few years apart is not a bad idea and can be monetarily rewarding. For example, i have heard and seen that if you stay within the same company for ‘x’ years, typically, compensation would grow linearly, but if you were to change companies at certain intervals, your compensation may grown more rapidly at least initially till you hit a saturation point or more like industry max for that particular profile. Something like this

http://www.dailymail.co.uk/news/article-2665716/The-key-earning-money-Change-jobs-two-years-People-work-employer-longer-earn-50-cent-lifetime.html

Aim to get a masters degree if possible. Most people question the ROI for investing in a masters degree. Based on what i have seen an individual would start of at a better pay after a master’s degree. For example:

an undergrad fresher may get hired at $40-50k per annum versus a grad fresher may get hired at $65-75k (these are approx numbers based on what i have seen here in NC in the last 3-4 yrs). Not to mention you would start off at a higher grade level (if the company that you get hired in has a grade structure) compared to when hired after undergrad.

so typically if you spend $50-70k for a masters degree and not be employed for 2 years while attending full time school ($100k approx ~2 years of no employment @ undergrad pay level), brings the total cost for a master degree at around $170k. I would still suggest going for it because of the above factors - you start off with $20-30k more base pay which means for years to come you will have that much more money in base pay which can get compounded year over year if you were to invest it wisely 😃 and you would also start at a higher grade level which in normal cases is worth 2-4 years of work (an undergrad starting at grade ‘x’ may take up to 2-4 years on an average to move up to grade ‘x+1’ within the same company).

Its good to be an all rounder, but very important to be a specialist. For example, if you are a CCNP R/S, security, wireless versus just a CCIE R/S (or in our example CCIE Wireless), the chances are that the latter with just one CCIE may make more money and may land up with a better job title. Again don’t quote me here, this is just what i have experienced. It may so happen that the technology you have invested in (built expertise in) may become obsolete or irrelevant in a few years and hence its not a bad practice to have a secondary technology focus that you can fall back on in dire straits. Personally, I have a master’s degree in electrical engineering, CCIE wireless, CWNE wireless but am still investing in my education (working on PMP and MBA) to safeguard my future. I can only try my bit to be more prepared for the future but the job market and bad situation is no one’s friend and can still affect you adversely.

Customer facing experience - if possible try and put yourself through a customer facing role. Customers is where the money comes from and its very critical for somebody who wants to rise up to higher ranks in the organization to have had prior customer facing experience. Example profile can be services, sales, PM, even customer support in some cases.

Link to the previous article:

http://wirelessonthego.postach.io/post/wi-fi-interview-questions-wi-fi-internships-jobs

Cisco Tetration Analytics

2016-06-22T15:02:46.479000Z

Cisco Tetration Homepage

http://www.cisco.com/c/en/us/products/data-center-analytics/tetration-analytics/index.html

Datasheet

http://www.cisco.com/c/en/us/products/collateral/data-center-analytics/tetration-analytics/datasheet-c78-737256.html

Cisco IOS-XE 3.6.5E Release Notes

2016-06-08T14:54:12.669000Z

What’s New in Cisco IOS XE Release 3.6.5E

Support for –B Domain—The FCC (USA) rule making on 5 GHz released on April 1, 2014 (FCC 14-30 Report and Order) goes into effect for products that are sold or shipped on or after June 2, 2016. Cisco APs and Cisco WLCs will comply with the new rules by supporting the new regulatory domain (– for the US and will create new AP SKUs that are certified under the new rules. Examples of new rules include new 5-GHz band channels permitted for outdoor use, and transmission (Tx) power level increased to 1W for indoor, outdoor, and point-to-point transmissions.

Note

Cisco APs and Cisco WLCs that are in the –A domain category can continue to operate and even coexist with –B domain devices without any issues.

We recommend that you upgrade Cisco APs and Cisco WLCs to the appropriate software release that supports –B domain.

–B Domain Compliant Cisco APs starting with Cisco IOS XE Release 3.6.5E are: Cisco Aironet 700, 700W, 1040, 1140, 1260, 1530, 1570, 1600, 1700, 2600, 2700, 3500, 3600, 3700.

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3e/release_notes/OL3262101.html#pgfId-964801

Regulatory Domain -B - Cisco APs

2016-06-06T16:08:45.280000Z

As many of you maybe aware that the new FCC update allows the use of additional channels 120, 124 and 128 as well as other power adjustment and updated DFS regulations.

https://apps.fcc.gov/edocs_public/attachmatch/FCC-14-30A1.pdf

The new regulatory domain -B is aimed to replace the current -A regulatory domain. Per the FCC order, access points shipped before June 1, 2016 are grandfathered to adhere to –A requirements. Access points shipped after the June 1 date must meet the –B requirements. This includes changes in DFS detection requirements, which must re-certify according to the new rules.

To support the -B access points, the WLCs would need to be upgraded to the appropriate codes. That said, it will be completely fine to mix -A and -B access points on the same controller and use in conjunction without any issues.

Full Cisco Blog article:

http://blogs.cisco.com/wireless/dont-sweat-the-small-stuff-its-okay-to-mix-cisco-access-points

Interop 2016 Keynote - Cisco’s Jeff Reed

2016-05-25T13:38:01.365000Z

Priming Universal AP on 3850 CA

2016-05-16T18:57:18.572000Z

1) confirm that the controller is on 3.7.0 code or higher for ap to be primed on the 3850/converged access.

2) to confirm the status of the ap, issue the command " sh ap status" . If you see country as UX this would mean ap is not primed:

3850#sh ap status

AP Name Status Mode Country

-------------------------------------------------------------------------

USCHIWAP01 Enabled Local US

APf4cf.e2a5.3b10 Enabled Local UX <<<<<<<<<<<<<<<<<<<<<<<<

USCHIWAP04 Enabled Local UX

APa0ec.f921.5538 Enabled Local US

AP881d.fce7.3b98 Enabled Local US

3) The config which needs to be put on the wlc is as given below:

a) configure a wlan:

wlan universal 5 unive

client vlan 55

no security wpa akm dot1x

security wpa akm psk set-key ascii 0 testing123

session-timeout 1800

universal-ap-admin <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

no shutdown

b) configure ap-group:

3850(config)#ap group universal

3850(config-apgroup)#wlan universal

3850(config-wlan-apgroup)#vlan 55

c) add the ap to the ap-group

ap name USCHIWAP04 ap-groupname universal

4) download air provision app on your phone. Make sure you have wifi and gps turned on.

5) now connect to the SSID broadcasted by the universal ap.

open the air provision app and follow the process given in the below given doc for air provisioning ( based on which phone you are using):

http://www.cisco.com/c/en/us/td/docs/wireless/access_point/ux-ap/guide/uxap-mobapp-g.html#92646

6) once the ap is primed you can check " sh ap status" and confirm the country code :

3850#sh ap status

AP Name Status Mode Country

-------------------------------------------------------------------------

USCHIWAP01 Enabled Local US

APf4cf.e2a5.3b10 Enabled Local US

USCHIWAP04 Enabled Local US

APa0ec.f921.5538 Enabled Local US

AP881d.fce7.3b98 Enabled Local US

Credit: https://www.linkedin.com/in/anvitha-prabhu-4829b5103

Cisco 2800 and 3800 AP - TechWise TV

2016-05-05T14:16:32.695000Z

Cisco’s 2800 and 3800 11ac Wave 2 APs are the latest AP offering from Cisco’s Wireless Business Unit. Some highlights -

Flexible radio assignment: Automatically defining radio frequency to better serve your specific environments
Turbo performance: Scaling to more devices running high-bandwidth applications
Multigigabit uplinks: Freeing up your wireless network with faster wireless offload
Hyperlocation antenna: Offering location-based services and security support with up to 1-meter accuracy
Bluetooth integration: Supplementing your traffic-based location data to improve analytics

Cisco CMX Cloud

2016-05-05T14:08:20.692000Z

See how the simplicity, agility, and affordability of CMX Cloud can help accelerate your business innovation

Cisco Bird’s Eye (Smart Trashcan etc.)

2016-05-02T18:05:50.329000Z

This is an awesome example of come collaborative work across different groups on new and innovative projects. I may be working on a Pilot deployment of this in the near future.

Wireless Sniffer Capture (How to)

2016-04-12T14:55:24.298000Z

Introduction

The process of collecting a good wireless sniffer trace, in order to analyze and troubleshoot 802.11 behavior, can be a difficult and time consuming operation. But there are a few things to bear in mind that will help simplify and speed up this process. With Wireless sniffing it helps to have an idea of what you are really trying to do - you are trying to capture the raw wireless frames from over the air, as seen by the wireless sniffing device itself.

Checklist for a successful capture

Step 1: Since the sniffing device, client device and AP are all using RF generating radios for transmission or reception, it helps to have your wireless sniffer close to your target device (the client machine). This will allow your sniffing device to capture a good approximation of what your client device is hearing over the air.

Step 2: Use a separate device to act as your wireless sniffer - you cannot take a good wireless sniffer trace if it is running on the device under test (the client machine you are trying to get a wireless trace of).

Step 3: Understand exactly what 802.11 Channel and Band your client device is using before setting up your capture. Lock your sniffer to the channel of interest - do not use the sniffer's "scan channels" mode! (With "scan channels", the sniffer will cycle from channel to channel every second or so - useful for a site survey or to find "rogues", but not when attempting to capture an 802.11 problem.)

Also bear in mind that your client device may roam to another AP which is on a different RF channel or Band, so you need to plan accordingly. Typically in the 802.11b/g (2.4GHz) environment, using a three channel sniffer may be required. This involves using 3 Wireless adapters on your sniffing device, with each one set to channel 1, 6 and 11. Using USB wireless adapters works best for this type of setup.

Step 4: If you are troubleshooting 5GHz, then the number of channels will dramatically increase. Since you might not have enough cards to capture all channels, it is a good practice for the test, to operate on not more than 4 channels on your surrounding Access Points.

Step 5: If you can reproduce the problem when a client roams from one channel to another, then a 2-channel sniff should suffice. If you have only a single channel sniffer available, then have it sniff the roamed-to channel.

Step 6: Always NTP sync your sniffers. The packet capture will need to be collated with debug captures, and with other wired and/or wireless captures. Having your timestamps even one second off will make the collation much more difficult.

Step 7: If you are capturing for a long period of time (hours), then configure your sniffer to cut a new capture file every 30MB or so. In order to avoid filling up your hard drive, you will want to put an upper limit on the number of files written.

Note: The Linksys USB600N does not reliably collect 11n packets with short guard interval. Missing 20% to 30% of short guard interval packets. If necessary the WLC configuration can be changed to only use the slower long guard interval. This should be only a temporary configuration change. The command is: config 802.11 {a | b}11nsupport guard-interval {any | long}

Sniffer Tools

Wireless Sniffing using a Mac with OS X 10.6 and above

Wireless sniffing on the Mac works well, as Mac OS X has built in tools to capture a wireless trace. However, depending on what versions of OS X you are running, the commands may vary. This document covers OS X 10.6 through 10.8.

Mac OS X Wireless Sniffing Tools

airportd (10.6-10.8)
airport utility (10.6 - 10.8)
tcpdump (10.8)
Wi-Fi Diagnostics (10.7, 10.8)
Wireshark (10.6 - 10.8)

airportd

If you are running OS X 10.6 (Snow Leopard) or above, then you can easily use the command line utility “airportd". Use the following steps:

Use the “command" + “Space bar" key combo to bring up the search diaglog box in the upper right top of the screen and type in the word “terminal", this will search for the terminal application, select this application to run it. A terminal window will appear.
Once you have a terminal window open, you can run the follow command to capture a Wireless sniffer trace on RF channel 11 (802.11b/g):

“sudo /usr/libexec/airportd en1 sniff 11"

Some things to note:

You will be prompted to enter in your account password for verification.
You cannot specify the name of the capture file or where you will place the output.

You will lose any wireless connectivity to your network while the capture is occurring.
If you are using an Air, the wireless adapter is en0 rather than en1

Once you are finished with the trace, hit “Cntl-C" to stop the trace and the utility will display the name and location of the capture file. The file format is your standard wireshark PCAP file that can be read on the MAC or Windows via Wireshark.

airport utility

The airport utility is is not a sniffer program; however, it can provide interesting information about the wireless LAN. Also, it has the ability to set the default wireless channel - which is crucial for sniffer programs (tcpdump, Wireshark) that are themselves unable to set the channel

Note: because the path to the airport utility is so ugly, it may be a good idea to set a symbolic link to it from a directory in the path, e.g.

# sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/sbin/airport

set the wireless channel

# sudo /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport --channel=48

dump out info on the SSIDs/BSSIDs seen:

# sudo /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s

SSID BSSID RSSI CHANNEL HT CC SECURITY (auth/unicast/group)

Test 00:24:97:89:cb:41 -53 11 Y -- WPA(PSK/TKIP/TKIP) WPA2(PSK/AES/TKIP)

Test2 00:24:97:89:cb:40 -53 11 N -- WPA(PSK/TKIP/TKIP)

Guest 00:22:75:e6:73:df -64 6,-1 Y -- WPA(PSK/AES,TKIP/TKIP) WPA2(PSK/AES,TKIP/TKIP)

detailed information on the current association:

# sudo /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport –I

agrCtlRSSI: -54

agrExtRSSI: 0

agrCtlNoise: -89

agrExtNoise: 0

state: running

op mode: station

lastTxRate: 300

maxRate: 300

lastAssocStatus: 0

802.11 auth: open

link auth: wpa2-psk

BSSID: 0:24:97:95:47:60

SSID: GuestNet

MCS: 15

channel: 36,1

tcpdump

Tcpdump is a command line utility shipped with OS X that can perform packet capture. (The tshark utility bundled with Wireshark is very similar.) To perform a wireless packet capture using tcpdump:

first set the channel using the airport utility as shown above
then perform a wireless packet capture, saving to a file. When done, type Control/C to exit.

Example:

bash-3.2# tcpdump -I -P -i en1 -w /tmp/channel-11.pcap

tcpdump: WARNING: en1: no IPv4 address assigned

tcpdump: listening on en1, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 65535 bytes

897 packets captured

968 packets received by filter

0 packets dropped by kernel

bash-3.2#

Wi-Fi Diagnostic

If you are running MAC OsX 10.7 (Lion), you can use the graphical program called Wi-Fi Diagnostics. It’s located in the following folder:

/System/Library/CoreServices

Normally this folder is not easily accessible so a quick trick is to open the “Finder" and use the "Go to folder" (“Shift-Command-G") option; this will open up a dialog box in which you can enter “/System/Library/CoreServices" and press return. There you will find the Wi-Fi Diagnostics program.

Here is a example of using the tool to monitor Wi-Fi Performance:

Here is any example of using the tool to record Wi-Fi Events:

Here is any example of how to enable the Debug logs to be taken, this will allow you to see all messages that occur at the driver and supplicant level on the MAC

Here is an example of using the tool to capture raw Wireless frames that can be heard by the MAC.

In order to capture a complete wireless trace, select “Capture Raw Frames".

Check the box to disconnect from the network and select the channel that is being used by the client that are you sniffing. as you want to capture all data send and received on the network since we are using the sniffer to capture another wireless client’s frames

The trace will start after pushing the “Start Capturing" Button. Once you have finished the trace, push the “Stop Capturing" button and click on “Continue", a dialog will ask to either save the report to the Finder desktop or send it via an email.

Wireshark

Another option on the MAC to capture a wireless trace is to use Wireshark. This is a free program that can be downloaded from http://wireshark.org. (Note: this requires that X11 be installed - for OS X 10.8, this means downloading and installing Xquartz.)

Once installed and started, select the capture option and fill out the dialog as follows:

1) Capture using interface “en1" which will be the wireless interface on the MAC
2) Select “Capture packets in monitor mode" which is needed to allow Wireshark to capture all wireless frames on the network. (If running Wireshark 1.8, doubleclick the en1 interface to bring up the necessary dialog box.)
3) The channel being sniffed will be the channel the MAC was associated to when Wireshark is started. While it is possible to change the channel being sniffed, you must do this via the “Airport" command on the terminal application, as described above. (For more detail, see the following URL:http://wiki.wireshark.org/CaptureSetup/WLAN)

Wireless Sniffing using Windows 7 with Netmon 3.4

Introduction

With Microsoft Network Monitor (Netmon) 3.4, you can now perform some decent 802.11a/b/g (and maybe 11n) wireless sniffing in Windows 7, using your standard wireless adapter. The file saved from Netmon can be read by latest (1.5 and above) Wireshark, though not in OmniPeek.

Netmon 3.4 is supported with XP SP3; however, it does not support wireless sniffing when running XP. As to Vista, experience is mixed; a reliable source reports that wireless sniffing does work in 64-bit Vista on a Macbook with BCM43xx 1.0 adapter.

Tested adapters/drivers

An Intel 6300 running drivers 13.2.1.5 and 13.5.0.6, and an Intel 6205 running 14.2.0.10 and 15.9.1.2. These adapters works well with 11a/g but do not support 11n.
A Linksys WUSB600Nv1 with Ralink driver 3.0.10.0. This driver says that it supports 11n (which function I didn't test). It seemed to report all packets as having an RSSI of -50, and as being of data rate "3.5 Mbps".
An Atheros AR9285 with driver 8.0.0.258. Driver reports 11n support (not tested.) RSSI values and data rates look sound.
A Cisco CB21AG with Atheros driver 1.0.0.120 - this also reported weird data rates (1Mbps showed up as "116 Mbps" and 11 Mbps as "124 Mbps".)

Install Netmon 3.4

Download Netmon 3.4 from Microsoft. If running Win7 64bit, get and install NM34_x64.exe. You'll have to log off and back on again after installing.

Sniff wireless packets from a channel

Note: if using PROSet for Win7, set it to "Use Windows to Manage WiFi". Otherwise, PROSet is apt to take control of the adapter out from under Netmon, and you will wind up sniffing the wrong channel.

Launch Netmon. Check the wireless adapter of interest, and uncheck the others.

Click the New Capture button, then the Capture Settings button. This pops up the Capture Settings window. Highlight the adapter of interest and click Properties which pops up the Network Interface Configuration window.

In the Network Interface Configuration window, click [Scanning Options]. This pops up the WiFi Scanning Options window. Check Switch to Monitor Mode. Select the Select a layer and channel button. Select the band and channel of interest. (With Intel, use "11a" for 5GHz and "11g" for 2.4GHz.)

Click [Apply]. Important: do not click [Close and Return to Local Mode], but keep the WiFi Scanning Options window up all the time you're capturing the sniff.

Now (keeping the WiFi Scanning Options window open), go back to the Network Interface Configuration window and click [OK] to get rid of it. [Close] the Capture Settings window. Back in the main Network Monitor window, click Start.

This should now cause NetMon to capture all wireless frames. Sometimes though it will just sit there and not capture any frames. When this happens, try restarting NetMon, disabling/reenabling the adapter, etc.

When done, click [Stop] and use File -> Save as to save the .CAP file.

Analyze with Wireshark

Wireshark up through 1.4.x cannot read a Netmon 2 format file. However, latest Wireshark (1.5 and above) can. The screenshot below is from Wireshark 1.5.1.

Problems

Netmon recently just stopped being able to see my wireless adapter - it simply was not present in the Netmon start page, even though it was up and working fine. Rebooting did not help. Uninstalling Netmon Parsers, then Netmon, then reinstalling NetMon 3.4, then logging off, then logging back on, did work.

If Netmon isn't sniffing on the right channel, then make sure that you restart Netmon and follow the steps aboveexactly. One you've started setting up a capture session and have set the channel via the WiFi Scanning Options window, Netmon will not track subsequent changes in that window.

Wireless Sniffing using Cisco Lightweight Access Point (LWAP) in Sniffer mode

Introduction

You can use the Cisco WLC and LAPs in sniffer mode, in conjunction with a wired sniffer (feature designed for AiroPeek/Omnipeek, but can work also with Wireshark).

A single wired sniffer can collect packets from multiple APs, so this method is very useful to run multi-channel traces. For static scenarios, if it’s possible to move the sniffer AP, this can be used as an effective alternative to other sniffing options.

For roaming scenarios, the sniffer APs are usually installed in the proximity of the APs the client roams through, and this will report the “point of view" of the static APs rather than the client.

In order to see the RF from the point of view of the client while roaming, a multi-channel wireless trace should be captured using a laptop with multiple Wireless NICs that will follow the test client.

Configuration steps

1) WLC / AP side

Here are the steps in order to collect a trace using a sniffer mode LAP

Configure the AP in Sniffer mode:

The AP will reboot and it will not be able to serve clients.

Once the AP has re-joined the WLC, configure the radio of the AP (802.11b/g/n or 802.11a/n):
- specify the sniffer IP address
- select the channel
- enable sniffing

The sniffer will receive the 802.11 traffic encapsulated using the airopeek protocol, from the WLC management IP address with source port UDP/5555 and destination UDP/5000

2) Sniffer side: Wireshark

If using Wireskark to receive the traffic, (Note: you must use wireshark 1.6.8 or earlier, newer versions have this support broken and the packets will not be decoded correctly) follow the steps below:

Set the capture options to receive only traffic on UDP/5555:

This filter is optional but strongly recommended as it excludes all the non-wireless related traffic from the capture. Consider that the WLC sends traffic to a UDP port there’s no application listening on the sniffer side; this results in having a ICMP port-unreachable response for each packet received from the WLC.

Although this is expected, the filter above helps to exclude also this traffic which is useless and so it can only cause the trace to be bigger and more difficult to read.

Then, start the capture:

The captured traffic has to be “decoded as.." AIROPEEK in order to be able to see the 802.11 traffic:

Note: In Wireshark releases 1.8 and higher, AIROPEEK has been renamed to PEEKREMOTE.

The 802.11 traffic will now be visible:

The RF info shown above (e.g. the channel, signal strength, noise..) are added by the AP. Wireshark can decode only some of these elements, whereas OmniPeek will show all of them.

3) Sniffer side: OmniPeek

When using OmniPeek as the receiver of the traffic stream from the WLC/AP in sniffer mode, it’s first of all necessary to create a “Cisco Remote Adapter" under the “Adapter" menu of the “Capture Options" window:

At least one adapter is required; the name is a mandatory field, whereas the “IP Address" field can be left blank if you don’t want OmniPeek to filter the incoming traffic from a specific WLC.

In this case it’s not necessary to filter out any traffic (such as the ICMP port-unreachable) as OmniPeek will listen on the UDP port to specifically capture the data stream from the Wireless LAN Controller.

Before starting the capture, confirm the settings on the main OmniPeek window:

At this point the capture can be started and the result will be a trace including the RF info reported by the AP:

NOTE: By default OmniPeek remote adapter picks up the timestamp sent by the AP itself; this info has nothing to do with the AP clock, so the resulting timestamp will be incorrect. If you use a single sniffer AP the timestamps will be wrong but at least consistent; this is no longer true if you use multiple APs as sniffers (as every AP will send its own timestamp info, causing funky time jumps on the merged capture).

Solution

You can explicitly tell OmniPeek to use the local sniffer PC clock to set the packet timestamp.

This solves both the single and multi AP scenario, having correct and consistent timestamps as long as the PC running OmniPeek has a NTP-sync’d clock.

How-to steps:

In OmniPeek, do the following:

1. Go to Tools>Option>Analysis Modules

2. Search for cisco remote adapter then double click to bring out the options.

3. Tick on the Timestamp option then click OK and test again the capture.

Wireless Sniffing using OmniPeek Remote Assistant (ORA)

Introduction

Omnipeek Remote Assistant (ORA) - Cisco TAC can provide the Omnipeek Remote Assistant application to assist in performing wireless packet captures. The tool will capture wireless packets and encrypt them for processing by the TAC. A full version of Omnipeek Enterprise is required to decrypt and analyze the capture files.

Installation

You should receive a ZIP file from TAC – such as “ORADist_Default_7.0.zip" (the filename may change with different release versions). Unzip this file to some folder - to run ORA, simply launch OmniPeekRemoteAssistant.exe from that folder.

Supported Wireless Adapters and Drivers

Capturing Wireless Packets with ORA requires the use of supported Wireless Network Adapters along with the appropriate driver version. To view a complete list of supported adapters and drivers, please see:-

http://www.wildpackets.com/support/downloads/drivers

In most cases, the Ralink USB adapters will be the easiest to install - and, because you can install multiple USB adapters on a single laptop - they are the best way to get a multichannel capture. The following Ralink adapters have been tested by Cisco TAC:

Linksys WUSB600N (V1 and V2), Linksys AE1000, ALFA AWUS051NH

Driver Installation for Linksys USB600N with Windows XP

Step 1. TAC can provide the OmniPeek driver for the Ralink USB adapters. You should receive a ZIP file “RALINKUSB-1_4_0_18.ZIP". There will be 2 folders in the archive -- “Win2kXP" for 32-bit Windows and “WinXPx64" for 64-bit Windows. Extract the contents of the appropriate folder for your operating system to a specified location.

Step 2. Insert the Linksys USB600N adapter.

a. If this is the first time using the adapter on the workstation, Windows will start the New Hardware Wizard. Do not search for a driver automatically and click Next. Skip to step 3.

b. If you have previously installed the Linksys USB600N on your workstation, you will need to change the driver to the Omnipeek version. Go to Start > Control Panel > Network Connections and Right Click on the Linksys adapter and click Properties. In this example, the interface is “Wireless Network Connection 3".

Under the General Tab, Click the “Configure…" button, and then click on the Driver Tab > Update Driver. This will prompt the Hardware Update Wizard.

Step 3. Select “Install from a list or specific location (Advanced)" and click Next. Select “Search for the best driver in these locations.", include the location of your extracted driver files and click Next:-

Step 4. Windows will now search and install the Omnipeek driver. If you receive the following warning message, click “Continue Anyway".

Step 5. The driver installation should complete and the adapter is now ready for capturing packets with ORA.

Running Omnipeek Remote Assistant

If the correct driver isn’t loaded, ORA may appear to work, but not provide the option to select the desired channel to monitor. The Channel cell will read ‘Ethernet’ or ‘Wireless’ and not offer the option to select a channel:-

Capture Settings

Select the desired adapter(s) to perform the capture and indicate the desired channel. If you have multiple supported adapters installed you can capture on multiple channels simultaneously (but you cannot mix wired and wireless interfaces at the same time). You can select either an 802.11b/g channel or 802.11a channel in the dropdown. You can select 40 MHz 802.11n channels using the (n40l) or (n40h) options. The n40l will be the selected channel and adjacent lower channel, while n40h will be the selected channel and adjacent higher channel.

File Properties

Select the folder you would like to store the capture files in. You can then also specify the file rollover size. Each new filename will include a timestamp so data will not be overwritten.

Capture Control

If you have selected correct adapter/channel settings, you will now be able to click the Start/Stop buttons at the bottom. You will not be able to see the packets, but you will see the counters incrementing. Click Stop when finished

Cisco Digital Ceiling

2016-03-30T14:07:45.058000Z

Wi-Fi Interview Questions (Wi-Fi Internships/Jobs)

2016-05-03T01:45:33.504000Z

Hello there,

Over the course of my professional career I have had the opportunity to appear for few a interviews, and to interview others as well. For some people, giving an interview can be daunting specially if you don’t know how to prepare yourself for the interview. Oh btw I am referring to technical interviews here.

The key in my opinion to landing an interview call is certs. If you are a student pursuing an internship i would say its good to have / optional to have certs but its a huge edge over the competition if you do have relevant certs. For example, if you are seeking internships in the field of wifi, and if you have a CWNA cert of a CCNA Wireless, you definitely have a better chance of getting an interview. Please note that there is no guarantee that you will get an interview if you have a cert but it significantly increases your odds. Also, we are just talking about getting to the interview stage; IMO, its always about the interview and getting an interview call or not. Rest is totally up to ‘You’ as a candidate to convert the interview into an actual offer. Beyond your profile and your interview, there are various factors that play in between the interview and the offer stage. There is always the elements of right time and right place which plays a huge role in getting an offer.

For folks who are new grads and are pursuing Full-time positions in WiFi, I feel certs are a must have. Associate level for sure (example, CWNA, CCNA if not both then at least one) and preferably a professional level one too (e.g.: CWSP, CWAP, CCNP Wireless). I cannot emphasize this enough but I have come across many folks who have the certs but somehow don’t know their stuff. Its embarrassing to be in such a situation as an interviewer. Its a very disappointing feeling. I would highly encourage you all to focus on the content and know it well. Yes it good to have the actual cert but the cert is of no value if your knowledge can’t back that up. I would personally rather have you know your technology in depth than have the actual cert. But a combination of both of the above is ideal (having the cert and knowing what you are talking about 😃 ).

I think gone are those days where you could list courses like Advanced Operating Systems etc (some of the popular core courses) and hope to get an interview screen. I think you definitely need more than the courses to beef up your resume and hence please get at least 1-2 relevant certs during your degree. I think its ok to sacrifice taking an easier course or two so you can make some time for studying for certification(s). Which cert to target? Well, its tricky because to truly know WiFi, you do need to focus on the 802.11 protocol itself and books/certs like CWNP, O’Reilly survival guides are very good. That said, if you are aiming to land a job/internship at a Vendor like Cisco, HP etc,, its always a no brainer to have at least an associate level cert from that vendor. Again, ideally a combination of the above two would work great.

For vendor specific stuff, please get familiarized with the product portfolio, architecture, software release versioning etc. You can glance through some of the latest code’s release notes and get a understanding of the hardware, features etc from a high level. You don’t have to go too deep as its not expected to know the products without having any work experience. That said, there are several universities in the US (I think University of Colorado, UMD, etc) who have heavy coursework and lab assignments tailored around WiFi and some vendor hands-on as well. Candidates from these programs already have an edge over others.

The last point I’d like to mention is that you need to be on Linkedin. You need to have a professional social network profile (LinkedIn and if you want Twitter). Please reach out to folks in that industry for guidance/ tips etc. Many of the WiFi experts write blogs which have very useful information about the technology, current trends, vendor related stuff etc. Being active on such platforms don’t hurt a bit.

Below are some of the questions that an interviewer may ask during the interview. Honestly speaking I have asked some of these questions myself while interviewing others.

The content in article should be useful for entry level as well as experienced roles.

Sometimes you may find people on the interview panel who are not from wifi background and in that case you maybe asked questions around general routing and switching like STP, RIP, OSPF etc. Its good to have basic L2/L3 networking knowledge as well but its hard to prep for everything under the sun sometimes :/.

Note: This by no means is a cheatsheet or a hack to pass an interview. This is just to give you folks an idea about what kind of questions can be asked during a technical interview for a wifi (802.11) job. Also, the best use of this content is not to remember it word by word and repeating it during the interview but to take it as a guidance and learn the concepts behind it.

Describe the 802.11 Association process

Explain the frame exchange between the endpoint/client and the Access Point before the client goes into ‘RUN’ state and is authenticated and is able to pass traffic. Provide as much detail as possible. There can be spin off questions based on your response to this question. The answer is probe request, probe response, 802.11 open authentication request, auth response (success), client sends association/ reassociation request and AP responds to that with a association/reassociation response (success). After this depending on the security type of the WLAN/SSID, further frames are exchanged. in the below snippet of wireshark you can see the reassociation process followed by EAP/TLS handshake

Describe the process in detail on how wifi client gets on the wifi network and starts passing traffic

Pretty much the same answer as question 1.

Describe the generic EAP process

Talk about the different entities involved like the authenticator, endpoint, authentication server etc.

Explain EAP-TLS process

Explain EAP-PEAP

Describe in detail what happens when you open the web browser on a client to surf google.com

This article gives a very in-depth breakdown of the process. You just need to know the high level details mainly around DNS and HTTP request

http://igoro.com/archive/what-really-happens-when-you-navigate-to-a-url/

What is the difference between ‘Association frame’ and ‘Reassociation frame'

https://mrncciew.com/2014/10/28/802-11-mgmt-association-reqresponse/

https://mrncciew.com/2014/10/28/cwap-reassociation-reqresponse/

What is a near - far issues in terms of wifi

Please refer to CWNA Chapter on WLAN troubleshooting

What is the hidden node/terminal problem?

https://www.youtube.com/watch?v=BLEt10OkE4g

How would you troubleshoot low throughput issue on the wifi network

There is no real ‘correct’ answer for such open ended questions. The interviewer is trying to access your analytical thinking and troubleshooting skills. If the interview is for a customer rep or test engineer, this question would be very important.

Throughput issues can steam from variety of root causes. It is important to ask a few questions and understand what is the problem symptom before you get started. You should look at the data rate at which the client is connecting (802.11n, ac etc), what MCS rate and the clients capability, SNR, RSSI of the client to start off with. A handy tool is WLC / AP debugs logs in conjunction with Over-the-air 802.11 sniffer captures. You can follow the traffic pattern (you won’t be able to decode the actual qos data on most occasions) to try and get a sense of any RF issues (if you see too many Retries or rate downshift). On odd occasion if there is a bug you may land up with incorrect sequencing of the data frames, qos mis configs and potential A-MPDU issues. Next step once you are past the Layer 1 and 2 of the OSI model is to start exploring the layer 3 traffic (decapsulated, preferably at the VLAN level or default gateway). Check for TCP windowing issues or retransmit etc. The problem could be between specific hosts/ servers etc.

How would you troubleshoot one way audio issue

Typically one way audio issues stem from power mismatch between the AP and the VoWiFi device. The VoWiFI device has limited transmit power compared to the AP which can cause one way audio issues. The VoWiFi device can hear the AP communication even at relatively far off distances but at cell edge or beyond if the VoWiFi transmits data back, the AP sometimes cannot interpret the data leading to one way audio. This is the simplest form of one way audio issue. You need to determine if the communication is between 2 VoWiFi devices or one VoWiFi and one wired phone. There could be configurations that may block peer to peer communication which may potentially lead to one way audio or no audio between two VoWiFi devices. The way to troubleshoot such issue is normally double check the configurations are ok and adhere voice of wifi best practices and then delve into debugs + over the air captures for further isolating the problem.

Briefly explain 802.11r

https://en.wikipedia.org/wiki/IEEE_802.11r-2008

What are the data rates of 802.11b, 802.11g, 802.11a, 11n and 11ac (they can also ask history of 802.11b, g and a). There are too many 802.11n MCS rates so most likely you should not expect a question like that.

802.11n rates: http://mcsindex.com/

802.11ac MCS rates

http://wirelessonthego.postach.io/post/802-11ac-mcs-rates

Difference between dB, dBm, dBi

http://www.antenna-theory.com/definitions/decibels.php

http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-fixed/9218-quick-ref.html

What cell edge and cell overlap would you survey for a voice deployment

-65 to -67 dBm

http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Mobility/emob73dg/emob73/ch9_Voic.html

What data rates are beacons sent out / broadcasted?

Beacons are broadcasted at the mandatory data rates set on the 2.4 and 5GHz radios.

How many MCS rates are there for 802.11ac?

There are nine for a specific Spacial stream. http://wirelessonthego.postach.io/post/802-11ac-mcs-rates

Modulation techniques -

http://www.ni.com/tutorial/7131/en/

http://www.wirelessdesignonline.com/doc/modulation-techniques-for-high-speed-wlan-sys-0001

What is antenna beamwidth

https://en.wikipedia.org/wiki/Beamwidth

Have you heard of 802.11ah?

https://en.wikipedia.org/wiki/IEEE_802.11ah

Explain in as much detail as possible when you try and ping a server on the internet

http://images.globalknowledge.com/wwwimages/whitepaperpdf/WP_Mays_Ping.pdf

Assuming the ping involves a packet being sent over an Ethernet or WiFi network, ARP is used to find the Ethernet hardware address of the device that receives the outbound packet. Typically this will be the router for the LAN the machine originating the ping is on.

The typical process is:

You enter a command to ping a destination.
DNS is used to determine the IP address (if needed).
The routing table is consulted to find the next hop towards that destination.
ARP is used to find the hardware address of the next hop.
The IP packet is sent to the next hop, encapsulated in an Ethernet or WiFi frame

What is MIMO, SU-MIMO, MU-MIMO, Beamforming etc

These are some of the most common terms you will come across while reading content on 11n and 11ac. The books i have referenced have all you need on these concepts

What is the difference between Active scanning and Passive scanning?

Passive scanning: Its the process where the client (STA) listens (on different channels) to the beacons from the AP or Ad Hoc station. The STA continues to listen to the beacons till its hears a beacon with the SSID of the network it wishes to join.

Active scanning: This involves the STA sending a probe request frame. The station sends the probe request frame when it is actively trying to join a specific SSID (network). The probe request frame will either contain the SSID name of the network or a broadcast SSID. If probe request is sent specifying a specific SSID, then only the APs serving the SSID will respond with a probe response frame. If probe request is sent with broadcast SSID then all APs within reach will respond.

TCP handshakes, TCP Windowing

You can google it :)

5GHz spectrum channels for WiFi use

http://wirelessonthego.postach.io/post/new-b-regulatory-domain-for-wlan-equipment-for-us

Common interferers on 2.4GHz

Microwave, 2.4 GHz video camera, 2.4GHz cordless phones, bluetooth devices etc

What is the difference between MSDU and MPDU

https://www.youtube.com/watch?v=fYPspcM68h0

https://mrncciew.com/2013/04/11/a-mpdu-a-msdu/

What is the difference between MSDU and A-MSDU

https://www.youtube.com/watch?v=fYPspcM68h0

https://mrncciew.com/2013/04/11/a-mpdu-a-msdu/

https://www.cwnp.com/forums/posts?postNum=286912

What is a guard interval

https://en.wikipedia.org/wiki/Guard_interval

https://wifijedi.com/2009/02/11/how-stuff-works-short-guard-interval/

How many (max) mac addresses are present in a 802.11 header

Four - Sender Address (SA), Transmitter address (TA), Destination address (DA) and Receiver address (RA)

http://community.arubanetworks.com/t5/Technology-Blog/802-11-MAC-Header-Breakdown/ba-p/219264

Difference between DCF and PCF

http://www.wi-fiplanet.com/tutorials/article.php/1548381/80211-Medium-Access-Methods.htm

http://www.vocal.com/networking/802-11-distributed-coordination-function-dcf/

https://en.wikipedia.org/wiki/Point_coordination_function

https://en.wikipedia.org/wiki/Distributed_coordination_function

What are the types of 802.11 frames?

Management, Control, Data frame and reserved

There can be so many more questions from these books below.

Below are some of the books, materials to review/read to better prepare yourself for the interview

CWTS
CWNA
CWSP
CWAP
802.11n Survival Guide O'Reilly
802.11ac Survival Guide O'Reilly

For Vendor specific (in this case Cisco since thats all I know :/)

http://www.cisco.com/c/en/us/td/docs/wireless/controller/8-1/Enterprise-Mobility-8-1-Design-Guide/Enterprise_Mobility_8-1_Deployment_Guide.html
CCNA Wireless 640-722 official cert guide
Designing and deploying 802.11 Wireless networks: A practical guide to implementing 802.11n and 802.11ac Wireless networks for Enterprise-Based applications (2nd edition) by Jim Geier
Deploying and troubleshooting Cisco Wireless LAN Controllers by Lee Johnson (this maybe outdated but still a good read for foundational level knowledge on Cisco architecture)

Cisco RRM (AireOS 8.x) White Paper

2016-03-22T15:16:34.458000Z

This is the latest spec on Cisco’s Radio Resource Management

http://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-2/b_RRM_White_Paper.pdf

Cisco Meraki MX Client VPN Settings

2016-02-26T14:03:37.132000Z

The client VPN service uses the L2TP tunneling protocol and can be deployed without any additional software on PCs, Macs, iOS devices, and Android devices, since all of these operating systems natively support L2TP VPN connections.

Client VPN Server Settings

To enable Client VPN, choose Enabled from the Client VPN server pulldown menu on the Security Appliance > Configure > Client VPN page. You can configure the following Client VPN options:

Client VPN subnet: The subnet that will be used for Client VPN connections. This should be a private subnet that is not in use anywhere else in your network. The MX will be the default gateway on this subnet and will route traffic to and from this subnet.
DNS Nameservers: The servers VPN Clients will use to resolve DNS hostnames. You can choose from Google Public DNS, OpenDNS, or specifying custom DNS servers by IP address.
WINS: If you want your VPN clients to use WINS to resolve NetBIOS names, select Specify WINS Servers from the drop-down and enter the IP addresses of the desired WINS servers.
Secret: The shared secret that will be used to establish the Client VPN connection.
Authentication: How VPN Clients will be authenticated (see below).

Authentication

Meraki Client VPN uses both pre-shared key based authentication and user authentication. To setup the user authentication mechanism, you will need to select your authentication method.

Meraki Cloud Controller authentication

Use this option if you do not have an Active Directory or RADIUS server, or if you wish to manage your VPN users via the Dashboard. To add or remove users, use the User Management section at the bottom of the page. Add a user by clicking "Add new user" and entering the following information:

Name: Enter the user's name.
Email: Enter the user's email address.
Password: Enter a password for the user or click "Generate" to autogenerate a password.
Authorized: Select whether this user is authorized to use the Client VPN.

To edit an existing user, click on the user under the User Management section. To delete a user, click the X next to the user on the right side of the userlist.

Important

When using Meraki hosted authentication, the user's email address is the username that is used for authentication.

RADIUS

Use this option to authenticate users on a RADIUS server. Click Add a RADIUS server to configure the server(s) to use. You will need to enter the IP address of the RADIUS server, the port to be used for RADIUS communication, and the shared secret for the RADIUS server.

Active Directory

Use this option if you want to authenticate your users with Active Directory domain credentials. You will need to provide the following information:

Short domain: The short name of your Active Directory domain.
Server IP: The IP address of an Active Directory server on the MX LAN.
Domain admin: The domain administrator account the MX should use to query the server.
Password: Password for the domain administrator account.

For example, considering the following scenario: You wish to authenticate users in the domain test.company.com using an Active Directory server with IP 172.16.1.10. Users normally log into the domain using the format 'test/username' and you have created a domain administrator account with the username 'vpnadmin' and the password 'vpnpassword'.

Your Short domain would be 'test'.
Your Server IP would be 172.16.1.10.
Your Domain admin would be 'vpnadmin'.
Your Password would be 'vpnpassword'.

For detailed instructions on how to configure a client VPN connection on various client device platforms, please refer to:

New -B Regulatory Domain (for WLAN equipment) for US

2016-02-24T02:26:50.541000Z

In Accordance to the FCC 14-30 order, new channels have been added as a part of -B domain. A quick view of the current, new and future channels for 5GHz spectrum is as shown below-

Cisco Wireless 2800 and 3800 Access Point Overview

2016-02-24T02:27:11.552000Z

Fluke Aircheck Wi-Fi Tester

2016-02-24T02:27:35.330000Z

Hello All,

I finally have got my hands on an Aircheck tester. I plan to use this device to locate rogue AP, do daily troubleshooting etc. I plan to share how to videos, cheatsheets etc to the wifi community for later reuse. I am not promoting the tools nor has Fluke networks reached out to me for this. Although it would be nice for them to give me a free tool since this content will help their product a lot :).

Lets dive right into it.

Air check Quick start guide that comes with the tool

Download PDF

Aircheck V3.0 Getting Started guide, Rev 5

(http://www.flukenetworks.com/findit/9829940)

What’s in the box?

Intro video to the ‘Networks’ tab on the home page

Intro to the 'Access Points’ tab on the home page

Intro to the ‘Channel Usage’ tab on the home page

Creating a new network profile or editing existing one

Bulk edit ACL using AirCheck Manager

The screenshot below show the AirCheck Manager interface. There are two main windows, one for on device info and other for locally saved info on the laptop

For editing the ACL using the manager, ‘open’ the profile which you want to edit. In this case i just have one profile called ‘Viten’. Once you open the profile, go to the Access Point tab

Now, just click on the ‘Add’ button 2-3 times to create some dummy BSSID’s like below

Next export this list. The file extension will be *.acl. You can open this file using a text editor like notepad++. The list layout is simple column separated. Now if you have a list of BSSIDs of your corporate or known Access Points (you can get the list from a saved session on the wifi tester itself, or export it from the WLC or Cisco Prime). You can mark all the known BSSID as ‘authorized’ in the .acl file as shown below

Save the file and reimport it back to the Access Point tab on the profile page. Done!! you have now marked all the trusted APs as ‘authorized’. The video below shows the updated profile on AirCheck tester with a authorized sign against the APs broadcasting the SSID ‘blizzard’ in my case. The rest of the BSSID are still tagged as ‘unauthorized’ since that is my default tagging.

Connecting to an AP using the created network profile and running ping test

Part 1, Fluke tester failing authentication

Part 2, connection successful and ping test

Converged Access SPG Design

2016-02-24T02:27:35.932000Z

Have put together a quick video on the SPG design scenarios

Case 1: Single MC branch with 15-25 APs. In this case there is a single SPG (eg: SPG1) for the MC

Case 2: Single MC with 1 or more MA having around 25-50 APs. Again use a single SPG (eg: SPG1) per MC and add all the MA’s to SPG1

Case 3: Large Branch or small campus with single MC and multiple MA’s (MC running release 3.7.x which can hold up to 100 APs). Single SPG (eg: SPG1) and all MA’s added to that SPG

Case 4: Large campus with 2 MCs (200 APs for release 3.7.x) and multiple MA’s. Use a single SPG for each MC (eg: SPG1 for MC1 and SPG2 for MC2). The SPG name is locally significant to the MC so you can use the same SPG name for both MC if you want to.

Case 5: Very large campus with RF separated buildings (like most Cisco campuses). Mostly 1 to 2 MC per building and use single SPG per MC

Cisco Smart Licensing on Wireless LAN Controllers

2016-02-24T02:27:58.914000Z

Cisco Mobility Express - Software Update

2016-01-21T14:36:34.164000Z

Cisco WLC AireOS 8.2 Advanced UI Video Series

2016-02-24T02:27:41.457000Z

WLC Advanced UI Series 01 - Monitoring Dashboard

WLC Advanced UI Series 02 - Access Point Detail

WLC Advanced UI Series 03 - AP Performance and Client Summary

WLC Advanced UI Series 04 - AP RF Troubleshooting

WLC Advanced UI Series 05 - Client Summary

WLC Advanced UI Series 06 - Client Connectivity and Mobility States

WLC Advanced UI Series 07 - Client Troubleshooting