Question

how to configure security on Dot11Radio0 interface on cisco 871W router

Asked by: ibanez7

Hello everyone

I just finished configuring a cisco 871W router and have the Wireless also up and working but am unable to figure out how to configure the Dot11Radio0 interface for security. At the moment it's wide open so anyone can basically access it. If possible i would like to get either some kind of example in order to be able to secure the Wireless interface.
I will add the file in router for you to see the configurations i have on there now.

This is basically what is configured for the wireless:
!
dot11 syslog
!
dot11 ssid R3WLAN
   authentication open
   guest-mode
   infrastructure-ssid

interface Dot11Radio0
 ip address 10.1.12.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
 !
 ssid R3WLAN
 !
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
 54.0
 station-role root
!

Again like i mentionned i will attach a file with complete configs for easier understanding.

Thanks for any help with this issue.

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

  • Plus...
  • 30 Day FREE access, no risk, no obligation
  • Collaborate with the world's top tech experts
  • Unlimited access to our exclusive solution database
  • Never be left without tech help again

Subscribe Now

Asked On
2009-09-29 at 09:08:46ID24770594
Topics

Consumer Firewalls

,

Enterprise Firewalls

,

Network Software Firewalls

Participating Experts
1
Points
500
Comments
8

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

  • "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
  • "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
  • "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Screenshot of Experts Exchange Knowledgebase

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Screenshot of an Article

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Screenshot of Experts Exchange Knowledgebase

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Related Solutions

  1. Cisco 1811W Wireless Guest Access
    Hello folks, I've spend 20 of the last 24 hours trying to figure out how to configure wireless access on this router, but still have two problems I can't seem to fix. First is that the guest access wireless SSID isn't working (VLAN24 - SSID="GUEST_ACCESS"); if I do...
  2. Creating Guest VLAN for wireless Cisco 1100
    I have a Cisco AP1100 with one SSID and puts all users onto VLAN 1of the 2950 switch to which it is connected. I would like to create a guest VLAN that would put guests onto another VLAN - say VLAN 111. I am seeking the basic steps required at the switch and AP to add a gue...
  3. Cisco Wireless Two SSID's
    I've got a cisco aironet and I'm trying to have two SSID's one with WPA security the other with wep (for our kids nintendo ds's). Or if I must no security at all on the second SSID (nintendo) if it can't be done, but in that case i'd prefer the SSID was hidden. Our neighbor...
  4. Cisco 871w ssid problem
    Can I get someone else to take a look at this for me. I'm able to plug into FA1 and statically assign my ip and get to the internet. My issue is that my ssid's aren't working right. SVBCOpen is asking for a password SVBCStaff is not showing up Also could you tell me why...
  5. Mac filtering on a specific SSID using a Cisco 871W router?
    I have a Cisco 871W set up that is going to get shipped off to a new remote office my company is opening up. It's set up such that it has one VLAN for employees, which gives them access to our corporate network via VPN, and another VLAN for guests which only provides access ...
  6. Cisco 1131ag multiple SSIDs
    Hello. I have a Cisco 1131ag plugged into my LAN switch (a DLink managed switch). I configured the AP to have 2 VLANs (1 and 2). VLAN1 is configured for my WPA SSID which works fine. I can connect and get an IP from my domain controller. I created a second SSID on VLAN2 and...

Free Tech Articles

  1. WARNING: 5 Reasons why you should NEVER fix a computer for free.
    It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
  2. SCCM OSD Basic troubleshooting
    SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
  3. Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
    This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
  4. Create a Win7 Gadget
    This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
  5. Outlook continually prompting for username and password
    There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
  6. Backup Exchange 2010 Information Store using Windows Backup
    There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

  1. Avoiding Bugs in Microsoft Access
    Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
  2. Top 10 Best New Features in Visio 2010
    Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
  3. IT Consultant Business Secrets Revealed
    Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
  4. Disaster Recovery and Business Continuity
    Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
  5. Organize Your Visio Diagrams with Containers and Lists
    Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
  6. How to Us Objects, Properties, Events and Methods in Microsoft Access
    Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

 

by: sarangk_14Posted on 2009-10-01 at 02:20:00ID: 25467010

Hi,

Check this link out: It has sample configuration for the 871W

http://www.cisco.com/en/US/solutions/collateral/ns340/ns517/ns430/ns855/white_paper_c11-492842.html

Hope this helps.

Warm regards,
Sarang

 

by: ibanez7Posted on 2009-10-02 at 04:16:28ID: 25476756

thanks very much i will look into this within the next couple of days...been called on an emergency then i'll try and figure this out by following this guide then i will get back to you and post my solution or come back for more help...lol

 

by: ibanez7Posted on 2009-10-05 at 17:43:29ID: 31634946

thanks...haven't completed it yet but am sure this will help out.

 

by: ibanez7Posted on 2009-10-07 at 14:15:39ID: 25520185

Hello again
This is where i'm at with this. I can now connect to the secure wireless but with little or no connectivity therefore no internet access.
I do have the wired section working no problem with internet access but not the wireless.
 I am also receiving an error. This is the error in question:
871W_shop#
*Mar  9 05:46:06.311: %DOT11-6-ASSOC: Interface Dot11Radio0, Station   AAAA.AAAA.AAAA
Associated SSID[R3WLAN] AUTH_TYPE[OPEN] KEY_MGMT[WPA PSK]

871W_shop#
*Mar  9 05:46:13.979: *** Not encrypted dot1x packet from AAAA.AAAA.AAAA has been discarded

871W_shop#
*Mar  9 05:46:43.979: *** Not encrypted dot1x packet from AAAA.AAAA.AAAA has been discarded

(As for no internet access i think i'm missing the ip nat inside command on the vlan 20 interface if i'm correct?)

Here is the router configuration:
871W_shop#sh run
Building configuration...

Current configuration : 2991 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname 871W_shop
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$2FKI$MGKxCNAeP7FcY3U.kkPCI.
!
no aaa new-model
!
!
dot11 syslog
!
dot11 ssid R3WLAN
   vlan 20
   authentication open
   authentication key-management wpa
   wpa-psk ascii 0 abcdefg
!
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 192.168.15.1 192.168.15.59
ip dhcp excluded-address 10.1.1.1 10.1.1.10
!
ip dhcp pool Admin_pool
   import all
   network 192.168.15.0 255.255.255.0
   default-router 192.168.15.1
   dns-server AAA.BBB.CCC.DDD
!
ip dhcp pool Wpool
   import all
   network 10.1.1.0 255.255.255.0
   default-router 10.1.1.1
   dns-server AAA.BBB.CCC.DDD
!
!
ip auth-proxy max-nodata-conns 3
ip admission max-nodata-conns 3
no ip domain lookup
ip domain name rtp.cisco.com
!
!
!

!
!
archive
 log config
  hidekeys
!
!
ip ssh version 1
!
bridge irb
!
!
interface FastEthernet0
!
interface FastEthernet1
!
interface FastEthernet2
!
interface FastEthernet3
!
interface FastEthernet4
 description WAN int IP AAA.BBB.CCC.DDD 255.255.255.0 to Internet gateway
 ip address AAA.BBB.CCC.DDD AAA.BBB.CCC.DDD
 ip nat outside
 ip virtual-reassembly
 duplex auto
 speed auto
!
interface Dot11Radio0
 no ip address
 !
 encryption vlan 20 mode ciphers tkip
 !
 broadcast-key vlan 20 change 30
 !
 !
 ssid R3WLAN
 !
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
 54.0
 station-role root
!
interface Dot11Radio0.2
 description Internet access
 encapsulation dot1Q 20
 bridge-group 2
 bridge-group 2 subscriber-loop-control
 bridge-group 2 spanning-disabled
 bridge-group 2 block-unknown-source
 no bridge-group 2 source-learning
 no bridge-group 2 unicast-flooding
!
interface Vlan1
 description router subnet 192.168.15.0 /24
 ip address 192.168.15.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
interface Vlan20 ************************should i add the command ip nat inside???
 no ip address
 no autostate
 bridge-group 2
 bridge-group 2 spanning-disabled
!
interface BVI2
 ip address 10.1.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly
!
ip default-gateway AAA.BBB.CCC.DDD
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 FastEthernet4
!
no ip http server
no ip http secure-server
ip dns server
ip nat pool OUTSIDE_NAT AAA.BBB.CCC.DDD AAA.BBB.CCC.DDD netmask 255.255.255.0
ip nat inside source list 101 pool OUTSIDE_NAT overload
!
access-list 101 remark OUTSIDE_NAT acl allowed networks
access-list 101 permit ip 10.1.1.0 0.0.0.255 any
access-list 101 permit ip 192.168.15.0 0.0.0.255 any
access-list 101 permit ip any any
!
 --More--
*Mar  9 05:48:13.979: *** Not encrypted dot1x packet from AAAA.AAAA.AAAA has been discarded
!
!
control-plane
!
!
line con 0
 exec-timeout 0 0
 logging synchronous
 login local
 no modem enable
line aux 0
line vty 0 4
 login local
!
scheduler max-task-time 5000
end

Now i believe I should at least add the command ip nat inside for the vlan 20 correct?
As for the error itself i have no idea why i'm getting this dot1x not encrypted .
Thanks for any help with this.

 

by: sarangk_14Posted on 2009-10-07 at 22:30:12ID: 25522496

Hi,

What's the version of the IOS?
Kindly check whether the authentication and encryption types on the client(s) match with that on the AP/ router.

Warm regards,
Sarang

 

by: sarangk_14Posted on 2009-10-07 at 22:31:30ID: 25522505

Also try and change the broadcast key value to 60 or 3600.

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...