Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Wireless Lan controller through Cisco asa

Posted on 2014-02-27
6
Medium Priority
?
1,490 Views
Last Modified: 2014-04-04
We have a cisco 5508 wireless lan controller that I'm trying to configure for guest access.  It connects to the guest ssid and obtains an ip address but can't the web page at 1.1.1.1 doesn't open up.    I'll describe my topology a bit.  

Our wlc is configured as a dhcp server and to give a scope of addresses with the cisco asa being the default gateway.  The guest wireless is assigned to vlan 205 on the wlc.  The port on the switch the wlc is connected to is trunked to allow vlan 205 among others.   The cisco asa has an interface configured on the subnet of vlan 205 and is connected to the switch in a port that is configured as switchport access vlan 205.   The interface on the cisco asa vlan 205 is also set with the security level of 5.

When i connect to the wireless guest, i can't ping 1.1.1.1, or the vlan 205 ip address of the wlc.  I'm obtaining a dhcp address from the wlc but that's it.  

Any help would be much appreciated.   thanks so much
0
Comment
Question by:techlinden
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
6 Comments
 
LVL 47

Expert Comment

by:Craig Beck
ID: 39894370
The 1.1.1.1 address isn't actually a routable address - it's just what's used by the WLC to 'grab' your traffic.  If you're successfully associated and authenticated you should be able to see the guest login page but you won't ping its address.

Can you go to the Clients page on the WLC, then click on the MAC address of the client and post a screen-shot of the details?

Can you also post a screenshot of the WLAN's Layer2 and Layer3 pages under the Security tab?
0
 

Author Comment

by:techlinden
ID: 39895303
Well, when i change the routing to not use the asa but to use our nexus switch at the datacenter, i get the login page and can log in.    I'm wondering if it's something as simple as cable not plugged into the correct port.   Both the nexus and asa are at our datacenter.  I noticed when i shut down the interface on the nexus switch that is labeled as going to the guest wireless in the nexus, the corresponding interface on the cisco asa doesn't shut down.     I'm thinking it should?
0
 

Author Comment

by:techlinden
ID: 39895305
I meant to write going to the guest interface on the asa.  when i shut down the port on the nexus, the corresponding port on the asa stays up.
0
Learn how to optimize MySQL for your business need

With the increasing importance of apps & networks in both business & personal interconnections, perfor. has become one of the key metrics of successful communication. This ebook is a hands-on business-case-driven guide to understanding MySQL query parameter tuning & database perf

 

Author Comment

by:techlinden
ID: 39896024
Actually, i think it is the right port because when i disable the port on the asa the corresponding nexus port goes down.   What's weird is that every other interface that goes into the nexus, i can issue the command sh mac address-table interfacexxx or sh mac address-table address (mac address of asa interface), it will show the vlan on the nexus that that interface asa is connected to.  When i issue those commands on my guest interface, i come up with nothing.
0
 
LVL 47

Accepted Solution

by:
Craig Beck earned 1500 total points
ID: 39898782
Well, when i change the routing to not use the asa but to use our nexus switch at the datacenter, i get the login page and can log in.
This isn't actually a routing issue then, although it may appear as though it is.

What's happening is the client can't resolve anything via DNS when connected via the ASA.  This is crucial in order for the client to be redirected.  If the client can't resolve a hostname the WLC won't see any HTTP traffic to redirect.

If you allow DNS resolution through the ASA this should work fine.
0
 

Author Comment

by:techlinden
ID: 39978301
i still believe it to be a firewall issue.  i can't get connectivity established between the asa and the nexus.  i understand what you're saying about dns connectivity and will make sure they can get to our internal dns what's the firewall issue is resolved. thx
0

Featured Post

Moving data to the cloud? Find out if you’re ready

Before moving to the cloud, it is important to carefully define your db needs, plan for the migration & understand prod. environment. This wp explains how to define what you need from a cloud provider, plan for the migration & what putting a cloud solution into practice entails.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

There’s a movement in Information Technology (IT), and while it’s hard to define, it is gaining momentum. Some call it “stream-lined IT;” others call it “thin-model IT.”
You deserve ‘straight talk’ from your cloud provider about your risk, your costs, security, uptime and the processes that are in place to protect your mission-critical applications.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…
Suggested Courses

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question