Autonomous: Enable / Disable Web Browser Interface

 

How to enable or disable the web interface on a Cisco access point (autonomous) 

The web browser command in the CLI is

"ip http server" for port 80 HTTP

"ip http secure-server" for port 443 HTTPS

ENABLE

ap(config)#ip http server 

ap(config)#ip http secure-server

   

DISABLE - You negate the command with "NO"

ap(config)#NO ip http server

ap(config)#NO ip http secure-server

 

Pineapple v2 - Jasager -- “The Yes Man” (WiFi man in the middle attack)

 

Robin Wood (DigiNinja) and Darren Kitchen (Hak5) collaborate on the newest Pineapple release called the WiFi Pineapple Version 2. It is running Jasger --In German it means "The Yes Man".

So what is a Pineapple you ask?

Think of a wireless router that detects probe request from clients and this wireless router responds to these probe request with a probe response allowing ALMOST anyone to attach. I see the wheels turning, right ... cool stuff but there is more!

Robin Wood the author of Jasger which is installed on the Pineapple includes the linux program called "Karma". Karma is a web front end that allows you to direct traffic and allows you control of the web content.

So in short, think of man in the middle attack where people attach to you and you can filter and control their traffic and SO MUCH MORE. 

You can purchase one already pre-built for $109. 

http://www.hak5.org/store/wifi-pineapple-version-2

Leeched: http://www.digininja.org/jasager/ 

Jasager

Welcome to Jasager - Karma on the Fon.

Jasager is an implementation of Karma designed to run on OpenWrt on the Fon. It will probably run on most APs with Atheros wifi cards but it was designed with the Fon in mind as it is a nice small AP which gives it a lot of scope for use in penetration tests and other related fun.

A quick highlight of features:

• Web interface showing currently connected clients with their MAC address, IP address (if assigned) and the SSID they associated with
• The web interface allows control of all Karma features and can either run fully featured through AJAX enabled browsers or just as well through lynx
• Auto-run scripts on both association and IP assignment
• Full logging for later review
• Pluggable module system for easy extensibility
• Basic command line interface so you don't have to remember the different iwpriv commands

Please give your feedback, bug reports, comments, praise, etc either throughjasager@digininja.org or on the Hak5 forums.

To pre-empt the question of "Will this work on a laptop instead?", with some slight tweeking it should do but I haven't tested this for two reasons. First, from a security point of view, the web server needs to have some way to execute the iw and if commands. On the Fon everything runs as root by default so this doesn't really create any extra problems on top of what is already there but on a laptop it could be an issue. The second reason is because I have plans for a laptop version which will build on this and run in a much better way due to the extra processor/storage space.

I've recently worked with Orange from the Piranha project to integrate Jasager into his firmware. Together, but mostly Orange, we worked out how to make a Jasager Makefile so it could be built directly into the firmware and as a proper OpenWrt package rather than my original script which built the package with tar and gzip.

Uses

As with any tools, this tool can be used for good or bad. Here are some of the good uses:

• In your office - Set it up to capture laptops before the bad guys do. Use a website to remind them of the rules.
• On penetration tests - Lure in target clients to find a back door into networks
• At home - Have fun with neighbours who try to steal your wifi bandwidth 

Cisco Valet - Home Wireless

 

Cisco released a new product line called Valet Wireless Hot Spot this week. This is marketing to home users. It has parental controls, managed guest access and allows for easy configuration. It is also delivering 2x2 N. 

I ordered one to do some testing. The ol' lady doesn't like to be on my LAB wireless anyway as I ticker with it to much.  I'll post my evaluation once I'm done. Here is the specs:

There are (2) Models the Valet and Valet PLUS.

http://home.cisco.com/en-us/wireless/valet/

Model:	Valet (M10)
Technology:	Wireless-N
Bands:	2.4 GHz
Transmit / receive:	2 x 2
Antennas:	Internal
Ethernet ports x speed:	4 x 10/100
Software setup:	Easy Setup Key
Safer surfing:	Yes
Parental controls:	Duration Access Controls Specific Domain Blocking Child / Teen Website Filtering
Customer service:	24/7 Award-Winning phone and customer support
Warranty:	1 year hardware limited warranty

Model:	Valet Plus (M20)
Technology:	Wireless-N
Bands:	2.4 GHz
Transmit / receive:	2 x 2
Antennas:	Internal
Ethernet ports x speed:	4 x Gigabit
Software setup:	Easy Setup Key
Safer surfing:	Yes
Parental controls:	Duration Access Controls Specific Domain Blocking Child / Teen Website Filtering
Customer service:	24/7 Award-Winning phone and customer support
Warranty:	1 year hardware limited warranty

Cisco Flexes Muscle: The Death of CiscoBlog.com

 

Cisco flexes muscle to http://www.ciscoblog.com/. CiscoBlog started in December 2005 and this week ciscoblog.com announced they will need to render the name on July 4th. 

Just my 2 cents, "PISS POOR CISCO!" Ciscoblog is a site by an engineer for engineers centered around Cisco technologies. Stop by and show your support...

Posted on ciscoblog.com:

Well, after 5 fun years of running CiscoBlog.com, Cisco "agents" have come. I was contacted by Cisco a couple weeks ago stating that CiscoBlog.com violates their trademark. Being that CiscoBlog.com gets 600,000 hits monthly (isn't that amazing?!?) I thought I could at least get a box of t-shirts out of the whole deal. Unfortunately, the response went something like, "Mr. Anderson...this is a legal matter. We don't negotiate."

So...I have until July 4th to find a new domain name. I guess if I owned Cisco, I wouldn't want some hoodlum posting at CiscoBlog.com...so I understand the complaint.

...I just wanted a box of t-shirts out of the whole thing... :o)

ISM Band Frequency Refresher

 

I worked with a customer recently who was convinced the ISM band was only for 2.4 GHz band. Which is 100% incorrect! Here is a refresher … 

The ISM  (In the ISM Band) stands for "industrial, scientific and medical" radio bands. The ISM includes the following frequencies:

902 - 928 MHz                    (26 MHz in width)

2.400 - 2.4835 GHz           (83.5 MHz in Width)

5.725 - 5.875 GHz              (150 MHz in Width) ** Note 5.8 GHz ONLY**

This ISM bands were defined by the ITU Telecommunication Standardization Sector

http://www.itu.int/ITU-R/terrestrial/faq/index.html#g013

The ISM bands are governed by the FCC here in the United States and they are unlicensed.  This is found under title 47, part 18.

http://www.access.gpo.gov/nara/cfr/waisidx_07/47cfr18_07.html

Although the band is labeled as “industrial, scientific and medical” bands -- you will find almost everything and anything under the sun that is unlicensed in these frequencies. You name it, it rides these waves.  WiFi, cordless phones, Mircowave ovens, Bluetooth, toys, baby monitors, wireless cameras, etc !

Cisco CCIE Wireless - Expansion Of Lab Exam Topics V1.0 (Blueprint)

 

I applaud Cisco for providing a "Detailed Checklist of Topics to Be Covered". This will allow candidates to focus on topic specific subjects more closely. 

Please be advised that this topic checklist is not an all-inclusive list of Cisco CCIE Wireless lab exam subjects. Instead, we provide this outline as a supplement to the existing lab blueprint to help candidates prepare for their lab exams. Other relevant or related topics may also appear in the actual lab exam.
 

Detailed Checklist of Topics to Be Covered

1.0	Implementing the Network Infrastructure to Support WLANs Configuring and Troubleshooting the Network Infrastructure to Support  WLANs
1.01.	Cisco Discovery Protocol
1.02.	VTP Modes (Server, Client, Transparent)
1.03.	VLANs vs. Routed Interfaces
1.04.	Trunks vs. Access Ports
1.05.	Load Balancing
1.06.	Link Aggregation
1.07.	Spanning Tree Protocol Manipulations
1.08.	HSRP
1.09.	Implementing Initial Network Connectivity in WLCs (Management Interface, AP-Manager, Virtual Interface, Service Port Interface, Dynamic Interface Configuration)
1.10.	VLAN Filtering
1.11.	WLC as DHCP Server
1.12.	Wireless Services Module (WiSM) Setup
1.13.	Configuring Power over Ethernet
1.14.	Configuring Client Supplicant (ADU, CSSC) to Connect and Authenticate to SSIDs Using EAP, PEAP, EAP-FAST, LEAP and EAP-TLS, WEP, WPA, and WPAv2
1.15.	Implementing Relevant Network and Management Services on Switches, APs, LWAPPs, Location Appliance Server, WLCs, and Cisco WCS (NTP, Syslog, DHCP, SNMP, FTP, TFTP, HTTP, HTTPS, Telnet, SSH)
1.16.	Implementing QoS Services over the Wired Infrastructure
1.17.	Configuring Marking Using DSCP
1.18.	Configuring Marking Using IP Precedence
1.19.	Configuring Marking Using CoS
1.20.	Configuring CoS to DSCP Mappings
1.21.	Configuring Policing (Modular QoS)
1.22.	Static Routing
1.23.	Basic Dynamic Routing (OSPF, EIGRP)
1.24.	Subnetting
1.25.	Troubleshooting Basic Network Connectivity Issues Using Traceroute, Extended Ping, Debugs, etc.
1.26.	Implementing Basic Enterprise Multicast (IGMP, PIM)
2.0	Implementing Autonomous Infrastructure Configuring and Troubleshooting Autonomous Infrastructure
2.01.	Implementing VLAN Trunking
2.02.	Understanding Mode of Operation for WDS and Infrastructure APs
2.03.	Implementing a WDS Solution
2.04.	Implementing a WDS Solution Using a RADIUS Server
2.05.	Implementing WDS Server Groups
2.06.	Configuring Infrastructure APs to Use the WDS Service
2.07.	Understanding the EAP Protocols That Are Supported from a Cisco IOS AP Configured as a Local Authenticator
2.08.	Configuring NAS Devices to Use the Local Authenticator AP
2.09.	MAC Authentication vs. EAP Authentication
2.10.	Assigning Shared Settings from a Group of Users, Such as SSID, VLAN, etc.
2.11.	Troubleshooting Failing Authentications
2.12.	Configuring SSID and MBSSID on the Autonomous AP
2.13.	Configuring and Assigning Different Characteristics to an SSID
2.13.1.	Security
2.13.2.	Authentication
2.13.3.	Encryption
2.14.	Mapping VLANs to SSIDs
2.15.	Advanced Radio Setting Parameters (Such as DTIM)
2.16.	Advertising (or Hiding) SSID Presence to WLAN Clients
2.17.	Understanding Radio Roles and Their Individual Attributes
2.18.	AP External Antenna Settings
2.19.	Impact of the Antenna Characteristics Settings
2.20.	Configuring Filters on AP Radio Interfaces
2.21.	AP Access Management
2.22.	Management Frame Protection
2.23.	Implementing Multicast Settings (IGMP, PIM)
2.24.	Implementing Wireless QoS
2.25.	Implementing Peer-to-Peer Blocking
2.26.	Configuring Client Access Limitations
2.27.	Troubleshooting Bridge Connectivity Problems
2.28.	Bridging Multiple VLANs Across a Point-to-Point Link
2.29.	Filtering VLANs Across a Point-to-Point Link
2.30.	Determining and Troubleshooting the Parent-Child Relationship in an 802.11 Bridge Link
2.31.	Fine-Tuning Point-to-Point Connections to Maintain a Reliable Link
2.32.	Converting Autonomous APs to LWAPP APs Using Different Methods (Upgrade Tool, Cisco WCS Templates)
3.0	Implementing a Unified Infrastructure Configuring and Troubleshooting a Unified Infrastructure
3.01.	WLC Interface Settings (Management Interface, AP-Manager Interface, Virtual Interface, Service Port Interface, Dynamic Interface)
3.02.	WLC – Tagged vs. Untagged Interfaces
3.03.	WLC – Link Aggregation (LAG vs. Backup Interface)
3.04.	WLC – SNMP
3.05.	Mobility – Asymmetric vs. Symmetric Tunneling
3.06.	Mobility Anchor
3.07.	Mobility – Layer 2 and Layer 3 Roaming
3.08.	Mobility – AP Failover Within a Mobility Group
3.09.	Mobility – AP Failover Outside a Mobility Group
3.10.	Troubleshooting Roaming Issues
3.11.	Implementing WLANs
3.12.	WLAN to Interface Mapping
3.13.	WLANs – Configuring DHCP (on Cisco IOS Software, Windows Server, and WLCs)
3.14.	WLANs – Configuring Peer-to-Peer Blocking
3.15.	WLANs – Configuring Layer 2 Security
3.15.1.	802.1X
3.15.2.	WPA vs. WPA2
3.15.3.	Static WEP
3.15.4.	Cisco Key Integrity Protocol
3.15.5.	TKIP
3.15.6.	Cisco Centralized Key Management
3.15.7.	PSK
3.15.8.	AES
3.16.	WLANs – Configuring WLAN Override
3.17.	WLANs – Configuring Access Point Groups
3.18.	WLANs – Configuring Radio Policies
3.19.	WLANs – Configuring AP Modes (Local, H-REAP, Monitor, Sniffer, Rogue Detector)
3.20.	WLANs – Configuring WLAN QoS Settings
3.21.	WLANs – Cisco Aironet Extensions
3.22.	WLANs - Client Exclusion
3.23.	WLANs – Web Authentication
3.24.	Implementing Ethernet Multicast Support on the WLC
3.25.	Configuring a Multicast IP Address
3.26.	Implementing and Controlling Management Access
3.27.	Different ACL Types
3.28.	CPU ACL
3.29.	Configuring Device Access Control
3.30.	Configuring Local Management Users
3.31.	Configuring Cisco Secure ACS (TACACS+ and RADIUS) for Authenticating, Authorizing, and Accounting
3.32.	Management Users
3.33.	Controller Redundancy
3.34.	Configuring Primary, Secondary, and Tertiary Controllers
3.35.	Implementing LWAPP Discovery Mechanisms
3.35.1.	OTAP
3.35.2.	Cisco IOS DHC
3.35.3.	DHCP Option 43
3.35.4.	Windows DHCP Server 2003
3.35.5.	Windows 2003 DNS
3.35.6.	Troubleshooting the Discovery Process
3.36.	Implementing Auto-RF to Adapt to Site Requirements
3.37.	802.11h
3.38.	Radio Resource Management Settings:
3.38.1.	Coverage Hole Detection Tuning
3.38.2.	Dynamic Channel Assignment (DCA) vs. Static
3.38.3.	Dynamic Transmit Power Control (DTPC) vs. Static
3.38.4.	RF Groups
3.39.	Validating Trap Generation, Notifications in Cisco WCS and WLC
3.40.	Wireshark and Cisco Spectrum Expert
4.0	Implementing Unified Controllers and APs Configuring and Troubleshooting Unified Controllers and APs
4.01.	Implementing Peer-to-Peer Blocking
4.02.	Implementing Security
4.02.1.	Configuring WPS Settings
4.02.2.	Configuring MFP and AP Authentication
4.02.3.	Configuring AP Authorization
4.02.4.	Rogue APs
4.02.5.	Configuring WLC IDS
4.02.6.	Configuring EAP-FAST
4.02.7.	Configuring EAP-TLS
4.02.8.	Configuring PEAP
4.02.9.	Configuring LEAP
4.03.	Applying an Access Control List to an Interface
4.04.	Applying an Access Control List to the Controller CPU
4.05.	Applying an Access Control List to a WLAN
4.06.	Implementing Wireless QoS
4.07.	802.11e Configuration (EDCA, WMM, etc.)
4.08.	Implementing Local EAP Authentication Against the Local User List
4.09.	Implementing Local EAP Authentication Against an External LDAP
4.10.	Implementing Layer 3 Security Policies (Web Authentication, Pass-Through, ACLs)
4.11.	Creating Guest User Accounts
4.12.	Lobby Ambassador
4.13.	Web Authentication
4.14.	Configuring Wired Guest Access (With or Without Anchor Controller)
4.15.	Configuring Wireless Guest Access (With or Without Anchor Controller)
4.16.	Anchor Controller
4.17.	Implementing Layer 2 Security Policies
4.17.1.	802.1X
4.17.2.	WPA vs. WPA2
4.17.3.	Static WEP
4.17.4.	Cisco Key Integrity Protocol
4.17.5.	TKIP
4.17.6.	Cisco Centralized Key Management
4.17.7.	PSK
4.17.8.	AES
4.17.9.	Mac Filtering
4.18.	Implementing Local DHCP Services for Clients on the WLC
4.19.	Implementing AAA (WLC to RADIUS and LDAP)
4.20.	Configuring the Cisco Secure ACS (RADIUS, TACACS+) Server
4.20.1.	ACS – User Setup Parameters
4.20.2.	ACS – Group Setup Parameters
4.20.3.	ACS – Network Configuration Parameters
4.20.4.	ACS – System Configuration Parameters
4.20.5.	ACS – External User Database Settings
4.20.6.	ACS – Reports and Activity
4.20.7.	ACS – Create and Enroll Server Certificate
4.20.8.	ACS – Global Authentication
4.20.9.	ACS – Group Mappings
4.20.10.	ACS – VLAN Assignment
4.21.	Adding AAA Clients
4.22.	Troubleshooting Client Connectivity Problems Using Extended Pings, Traceroute, and Debugs
5.0	Implementing Cisco Unified WCS and Location Configuring and Troubleshooting Cisco Unified WCS and Location
5.01.	Managing Cisco WCS User Accounts
5.02.	Adding Controllers to Cisco WCS
5.03.	Implementing Location Appliance Server to Cisco WCS
5.04.	SNMP
5.05.	Creating and Deploying Controller Templates
5.06.	Preparing Import Building and Floor Map
5.06.1.	AP Placement
5.06.2.	Antenna Orientation
5.06.3.	Calibration
5.07.	Creating a Floor Coverage Proposal Using the Planning Mode Tool
5.08.	Performing Maintenance Operations
5.09.	Performing System Tasks
5.10.	Tracking Parameters
5.11.	Filtering Parameters
5.12.	History Parameters
5.13.	Notification Parameters
5.14.	Asset Information
5.15.	Tune Location Services
5.15.1.	Tracking Parameters
5.15.2.	Notifications
5.15.3.	Timers
5.16.	Validating Client Connectivity and Troubleshooting the Client via Cisco WCS and WLC
5.17.	Validating Location Information in Cisco WCS and WLC
5.18.	Validating Security Events with Cisco WCS and WLC
5.18.1.	IDS
5.18.2.	Rogue Detection, Management
5.18.3.	Alarms and Events
5.18.4.	Alerts
5.19.	Validating Trap Generation and Notifications in Cisco WCS and WLC
5.20.	Running Reports
5.21.	Troubleshooting Client Roaming
5.22.	Troubleshooting Client Connectivity Issues
6.0	Implementing Voice over Wireless Configuring and Troubleshooting Voice over Wireless
6.01.	Implementing Support for Cisco Unified Wireless IP Phone 7920 and 7921 Deployments for both Unified and Autonomous
6.02.	Configuring Cisco Unified Wireless IP Phone 7920 and 7921 to Join the Call Manager
6.03.	Cisco Unified Wireless IP Phone 7920 and 7921 Profile Configuration
6.04.	Implementing Security Settings (Encryption and Authentication) on Phone and Infrastructure
6.04.1.	802.1X
6.04.2.	WPA vs. WPA2
6.04.3.	Static WEP
6.04.4.	Cisco Key Integrity Protocol
6.04.5.	TKIP
6.04.6.	Cisco Centralized Key Management
6.04.7.	PSK
6.04.8.	AES
6.05.	Fast Secure Roaming
6.06.	Configuring Voice QoS
6.06.1.	EDCA
6.06.2.	WMM
6.06.3.	CAC
6.06.4.	802.11e
6.07.	Configuring End-to-End QoS Marking (over Both Wired and Wireless Infrastructure)
6.08.	Audit Voice Deployment
6.09.	Troubleshooting Connectivity Issues

My80211.com “CWNA or BUST!”-- Giveaway! & Worldwide RSS Feed of your blog

 

I will be giving away (3) CWNP Study Guide Kits to 3 lucky and “committed” engineers  with a $100 exam reimbursement!

The giveaway will included: 

• CWTS Study Guide- The Official Sybex CWTS Study Guide (1st Ed., June 2009), the latest
• and most up-to-date study guide for the new PW0-070 CWTSP exam
• CWNA Study Guide- The Official Sybex CWNA Study Guide (2nd Ed., April 2009), the latest and most up-to-date study guide for the new PW0-104 CWNA exam
• CWSP Study Guide- The Official Sybex CWSP Study Guide (1st Ed., Feb 2010), the latest and most up-to-date study guide for the new PW0-204 CWSP exam
• Online Practice Test Set - Unlimited license to ALL 4 practice tests - CWTS, CWNA, CWSP, CWNE - over 1,500 questions!
• The CWNP 802.11n Video Training Course - over 5 hours of in depth training on the 802.11n amendment FREE! 

But this isn’t your normal giveaway!  It’s a giveaway with a twist! That’s right, what fun is there in just giving away free stuff!  There are strings attached to this puppy!! The lucky candidates will not be picked out of a hat or some random way. They will be selected!  (more on that in a bit)

GUIDES SPONSORED BY CWNP.COM

The 3 CWNP Study Guides are sponsored by CWNP (THANKS GUYS!).  We need to make sure these fall into the right hands, as I’m sure you would agree! In addition I will pony up the $100 kick back if you pass your exam (details below)!

With that being said, I am looking for (3) folks that are committed and I MEAN COMMITTED with ALL CAPS!. No “want to be” CWNAs, CWSPs, no CHEATERS (testking, pass4sure folks need apply!), no folks who lose interest after Chapter 2 either! I want 3 very hungry and passionate engineers who don’t understand the word quit and look at failure as a means of hitting the books harder to understand the concepts at hand!

The CWNP exams sets the stage for the fundamentals which will be used for a lifetime. I personally sat both the CWNA and the Cisco CCIE Wireless Written.  I found the CWNA to be more difficult then the IE written! That’s not a type O…  I’ve heard this statement from other peers who have sat both as well! It isn’t an easy test!

The professionals at CWNP -  Marcus, Kevin, Keith, Devin, GT, Compughter, myself and other contributors  are always on hand to answer your questions.  We believe in your success!

WHY THE GIVEAWAY

The question has been asked, why the giveaway. It’s simple. For those who know me personally and professionally, I enjoy sharing knowledge and collaboration at all levels of wireless. I have a passion for 802.11.  Over the years I’ve been blessed to work with some of the best RF engineers you will find in today’s enterprise.  I was recently blessed with an opportunity which has been a life long goal , an achievement of sorts. I know karma is a <S.O.B> too (LOL)!  I want to give back and keep the karma ball rolling! And what better way!

HOW TO APPLY AND STRINGS ATTACHED:

As I mentioned earlier, there are stings attached to this giveaway. Here is the how to apply and requirements. If you can’t meet these requirements for ANY reason please, I ask that you not apply. Only so that one of your peers may take advantage of this opportunity! If this is a success and we  grow a few  CWNA or CWSPs out of this giveaway we may just do this again!

Strings Attached:

In an effort to help others in their CWNP studies you will be given a personal blog that be hosted at www.my80211.com and be linked to www.cwnp.com ‘s worldwide RSS feeds, which includes FACEBOOK, LINKEDIN, CWNP.COM,TWITTER among others (thousands worldwide)…  When I said thousands worldwide, I mean thousands worldwide! You will be the envy of your peers, co-works and friends, I’m sure! No pressure right!

Your personal blog will be a requirement. We want to hear about your daily, weekly studies. Your ramblings (of course respect the RSS feed and no spamming ) . Any labs, packet captures, your study habits, gear that you are working on etc … You get the idea? We want to follow you in your journey to become a CWNP professional!

(Disclaimer: Any jokesters or unprofessional conducted or spamming over the RRS feed gets you kicked ASAP, no questions asked as these feeds are LIVE and broadcasted)

I would ask that your study efforts be such that you prepare yourself to sit the exam in 6 months from the time you get your kit. The cost of the exam is on you. But IF you pass in the 6 month window (and you didn’t cheat – testking, pass4sure etc .. I will have Kevin and Marcus check ), and you contribute to your blog as required I will reimburse you $100 of your exam when you pass! Doesn’t matter if you take it 5 times, if by the end of the 6 months you pass you will have earned your $100 kick back. If you don’t contribute to the blog, drop off the face of the earth and then pop up with a pass you will be hard pressed to get my $100! Capish!?

Oh and btw, this isn’t just for CWNA applicants. If you passed your CWNA and you plan to study for the CWSP this applies to you too! How could I forget you guys! Your blog will be of course, CWSP or Bust!  

How to APPLY:

Candidates will be selected and not picked at random. If you are interested , you should submit the following information to cwna.or.bust@wirelesssguru.net  (note there are three sss’s).

Tell me a little bit about yourself for example:

How will the CWNA /CWSP cert change your position, job, or career perhaps?
What will a CWNA or CWSP mean to you!?
Certifications you currently have and or pursing
Study material you used or using to pass or study those certifications
Why should you be the lucky candidates over the next guy
Tell me about your study plan and how you will get your cert in 6 months
And anything else you feel …

All applications will be reviewed by me and other CWNP professionals in private. A winner will be selected by 4/15/10.

Then its GAME ON MY FRIENDS!

Candidates should read the following:

Cheaters Never Prosper: http://www.cwnp.com/bbpress/topic.php?id=1808

What is the BEST way to prepare for CWNP exams? http://www.cwnp.com/bbpress/topic.php?id=7

THANK YOU CWNP!

I want to thank Kevin Sandlin @ CWNP for CWNP's contribution and sponsoring the 3 study guides and the RSS feed link! Thank you guys for all your efforts !

Cisco 6.0.196.0 is AssureWave Tested: See Solution Testing Results

 

Its been what, a year and a half since the WLC had an AssureWave Version? Below is the test results.

AssureWave Solution Testing Results

There are three types of AssureWave Certification:

• Passed: No major defects identified in tested areas
• Pass with Exception: Some defects that could affect certain deployments
• Failed: One or more major defects identified in core area

Tested Versions

4.2.207.0 - Test Results  (PDF - 1.66 MB)

• AIR-WLC2100-K9-4-2-207-0.aes (Passed)
• AIR-WLC4400-K9-4-2-207-0.aes (Passed)
• SWISMK9-4-2-207-0.aes (Passed)
• SWLC3750K9-4-2-207-0.aes (Passed)
• AIR-WLCM-K9-4-2-207-0.aes (Passed)

6.0.196.0 - Test Results  (PDF - 2 MB)

• AIR-WLC2100-K9-6-0-196-0.aes (Pass with Exception)
• AIR-WLC4400-K9-6-0-196-0.aes (Pass with Exception)
• AIR-CT5500-K9-6-0-196-0.aes (Pass with Exception)
• SWISMK9-6-0-196-0.aes (Pass with Exception)
• SWLC3750K9-6-0-196-0.aes (Pass with Exception)
• AIR-WLCM-K9-6-0-196-0.aes (Pass with Exception)

Keith Parsons sits with Jennifer Huber About Her Cisco CCIE Wireless Lab Attempt (Pod Cast)

 

Jeniffer discusses her Cisco CCIE Wireless Lab Attempt. Thank you Jenn for sharing. 

WLW: We’re glad to have Jennifer Huber with us to talk about her path to achieving CCIE Wireless including her first pass at the Lab. She shares with us some of her study techniques, and ideas on how to better prepare for this most difficult lab exam. 

http://wirelesslanprofessionals.com/wlw-009-ccie-wireless-lab-professional-reputation/ 

Cisco Wireless IP Phone (7921 / 7925) 1.3(4) Firmware Released

 

I've been a sleep at the wheel this week, busy with work, study and more work. Some interesting highlights in this release. WPA2 now supported with CCKM and Hardware Diagnostics!

Early reports from the forums I troll is that battery life appears to be less with this level of code. Also reports of better roaming are mentioned. Anyone out there testing this !? Would love to hear your feedback.

Hardware Diagnostics

Cisco Unified Wireless IP Phones are frequently returned and a replacement is requested when the phone is operational. In firmware 1.3(4), a self-diagnostic tool is available to determine if a valid hardware issue exists.

You can access the Diagnostics menu from the Phone Settings menu, where the Keypad, Speaker, Microphone and WLAN Radio and Antenna can be validated.

The WLAN diagnostics menu is the standard site survey utility, which will use the current network profile information to scan for the configured network.

Full CCKM Support

Cisco Centralized Key Management (CCKM) reduces the amount of delay time by centralizing the key management, which reduces the number of key exchanges. To optimize secure roaming, CCKM can be enabled while in WPA or WPA2 mode.

Prior to this firmware release, CCKM was not supported when WPA2/AES was selected; this required a full re-authentication when roaming between access points, and could result in loss of audio during the roam. Now that CCKM is supported when WPA2/AES is selected, the full re-authentication is no longer required and roaming to a new access point should not result in any perceptible loss of audio.

Firmware 1.3(4) provides full CCKM support of all WPA versions. 

Table 3 Open Caveats for the Cisco Unified Wireless IP Phone 7925G and 7921G 

Identifier	Headline
CSCte96010	Cisco Unified Wireless IP Phone encrypted audio stream may stop if RTCP is enabled
CSCtf28069	WEP key style selected on the web page is transferred incorrectly to the Cisco Unified Wireless IP Phone

Table 4 Resolved Caveats for the Cisco Unified Wireless IP Phone 7925G and 7921G 

Identifier	Headline
CSCta24387	Support restriction bit in `CallInfo'
CSCta28990	Cisco Unified Wireless IP Phone is stuck, intermittently, with empty prompt message after power cycle
CSCta35313	Cisco Unified Wireless IP Phone 7921G misinterprets idle URL with & (ampersand) character
CSCta46131	Cisco Unified IP Wireless IP Phone cannot handle multiple entries in the DNS response
CSCta47991	Cisco Unified Wireless IP Phone 7921G beacon reception enhancement
CSCta85098	Date and time may be reset if the Cisco Unified Wireless IP Phone 7925G battery is drained
CSCtb04590	Wireless IP Phone ignores Unified CM restart command during active calls
CSCtb12622	Automatic login for Personal Address Book does not work
CSCtb37829	No Connection Admission Control (CAC) response can result in choppy audio
CSCtb45669	Wireless IP Phone does not reprovision after receiving wavelink package
CSCtb49823	Support for virtual host web server on Cisco Unified Wireless IP Phone
CSCtb55584	Cisco Unified Wireless IP Phone 7925G MWI light is not properly displayed in `deviceinformationx'
CSCtb63016	Cisco Unified IP Wireless Phone 7921G has high battery consumption when the phone is idle on an active WLAN
CSCtc43993	The WLAN should not become active with `ClearPrompt' SCCP message
CSCtc44631	In the Japanese locale, the Cisco Unified Wireless IP Phone 7925G cannot select menu or help when there are more than 36 bytes in the title or status message
CSCtc54410	Cisco Unified Wireless IP Phone 7925G has voice gaps for inbound and outbound PSTN calls when connected to Unified CM Express
CSCtc73949	Received audio frame with mismatched codec may cause Digital Signal Processing (DSP) memory corruption
CSCtc79855	No Real-Time Transport Protocol (RTP) after adjusting volume while Wireless IP Phone receives RTP stream
CSCtc92119	Cisco Unified Wireless IP Phone 7921G data rate does not upshift after roaming from an 802.11b access point
CSCtd32102	Cisco Unified Wireless IP Phone 7921G backlight does not switch off at specified time when in cradle
CSCtd90133	High power consumption on call causes low battery life
CSCte99257	PEAP server validation is not saved to flash
CSCtf02245	A blank IP address is exported to the Wireless IP Phone when configured via the webpage

Autonomous: Understanding Cisco AP ARP Caching [Disabled] / [Enabled] / [Optional]

 

ARP Caching at the access point isn't something normally deployed in the field in my experience, but I wanted to cover it here.  I've done limited testing with this "nerd knob" function in the field. If you have this in production I would like to hear your feedback! 

ARP caching on an access point reduces the traffic on your wireless LAN by stopping ARP requests for client devices at the access point. The good is that you lessen the ARP traffic and lessen the use of the wireless medium. There is also a security benny. If you are familiar with aireplay-ng it works by capturing the ARP packet and replaying it back to the AP to generate traffic. By blocking the ARP at the AP you lessen the upstream ARPs to the wireless clients to be sniffed, but you still have down stream ARPs (wireless clients to LAN). 

ARP CACHE DISABLED:

ap(config)#no dot11 arp-cache <-- Negate dot11 arp-cache with "NO"

When ARP caching is disabled (its is by default), the access point forwards all ARP requests through the radio port to associated clients, and the client to which the ARP request is directed responds.

See FIG 1.

ARP CACHE ENABLED:

ap(config)#dot11 arp-cache <-- dot11 arp-cache ENABLED

When ARP caching is enabled, the access point responds to ARP requests for associated clients and does not forward requests to clients. When the access point receives an ARP request for an IP address not in the cache, the access point drops the request and does not forward it. Did your ears just perk up!? See Fig 2

ARP CACHE OPTIONAL: 

ap(config)#ap(config)#dot11 arp-cache optional <-- dot11 arp-cache OPTIONAL

When legacy and non-Cisco client devices are associated to an access point and not passing data, the access point might not know the client’s IP address. If this situation occurs frequently on your wireless LAN, you can enable optional ARP caching. When ARP caching is optional, the access point responds on behalf of clients with IP addresses known to the access point but forwards out its radio port any ARP requests addressed to unknown clients. When the access point learns the IP addresses for all associated clients, it drops ARP requests not directed to its associated clients.

 

Autonomous: Command History Buffer

 

By default, the Cisco autonomous AP records ten command lines in its history buffer. 

Beginning in privileged EXEC mode, enter this command to change the number of command lines that the wireless device records during the current terminal session:

 

ap#terminal history size ?

  <0-256>  Size of history buffer

Negate 

ap#no terminal history 

 

Beginning in line configuration mode, enter this command to configure the number of command lines the access point records for all sessions on a particular line:

ap#config t
ap(config)#line vty 0 4
ap(config-line)#history size ?
 <0-256>  Size of history buffer

Negate 

ap#config t
ap(config)#line vty 0 4
ap(config-line)#no history

** NOTE ** If you select 100 for example, it will record 100 lines.

Below is the show history output:

ap#show history

  en

  show terminal

  show history

  terminal history

  terminal history 200

  configure terminal

  terminal history size 200

  configure t

  config t

  terminal history size

  show history

Autonomous: Configure a Cisco AP to provide DHCP Services

 

In real world deployments you wouldn't likely use a Cisco AP as the DHCP server. But, during deployments I've used it for temporary setups. Lets step through the setup process

In this senerio we will set up a class C 192.168.1.0 DHCP Scope with IP exclusions and add additional info like the gateway and DNS server information.

1. Lets start with the client exclusion. We will exclude the following ranges, so that the AP doesn't assign these specific addresses out: 

192.168.1.1 - 192.168.1.10
192.168.1.200 - 192.168.1.254 

ap#config t

ap(config)#ip dhcp excluded-address 192.168.1.1 192.168.1.10

ap(config)#ip dhcp excluded-address 192.168.1.200 192.168.1.254

2. Next, we will name the DHCP Scope (pool) and set the network:

ap(config)#ip dhcp pool WIRELESS
ap(dhcp-config)#network 192.168.1.0

3. Next, we will set the LEASE time for the addresses (3 days,4 hours, 20 min) , setup the gateway and DNS:

ap(dhcp-config)#lease 3 4 20
ap(dhcp-config)#default-router 192.168.1.1
ap(dhcp-config)#dns-server 192.168.1.250

4. Next, we connect a wired laptop to the switch on the VLAN and see the results: 
(Note this will also hand out Wireless DHCP as well)

Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix  . :

        Description . . . . . . . . . . . : Intel(R) 82567LM Gigabit Network Connection
        Physical Address. . . . . . . . . : 00-2A-A1-13-C2-33
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . : Yes
        IP Address. . . . . . . . . . . . . . : 192.168.1.11  <-- This is the first IP in our Scope
        Subnet Mask . . . . . . . . . . . : 255.255.255.0 <-- Our class C 
        Default Gateway . . . . . . . . . : 192.168.1.1   <-- This is the GW we set up
        DHCP Server . . . . . . . . . . . : 192.168.1.2      <-- This is the IP of our AP
        DNS Servers . . . . . . . . . . . : 192.168.1.250  <-- This is the DNS we set up 
        Lease Obtained. . . . . . . . . . : Saturday, March 06, 2010 5:48:12 PM <--- This is our lease time we set up
        Lease Expires . . . . . . . . . . : Tuesday, March 09, 2010 10:08:12 PM

SPECIAL: All 3 CWNP Study Guides + All 4 CWNP Practice Tests for $100.00!

 

What a great value! The practice test alone are $200 if purchased separately! Don't miss this money saving opportunity! 

Your Order Includes:

• CWTS Study Guide - The Official Sybex CWTS Study Guide (1st Ed., June 2009), the latest
• and most up-to-date study guide for the new PW0-070 CWTSP exam
• CWNA Study Guide - The Official Sybex CWNA Study Guide (2nd Ed., April 2009), the latest and most up-to-date study guide for the new PW0-104 CWNA exam
• CWSP Study Guide - The Official Sybex CWSP Study Guide (1st Ed., Feb 2010), the latest and most up-to-date study guide for the new PW0-204 CWSP exam
• Online Practice Test Set - Unlimited license to ALL 4 practice tests - CWTS, CWNA, CWSP, CWNE - over 1,500 questions!
• The CWNP 802.11n Video Training Course - over 5 hours of in depth training on the 802.11n amendment FREE!

http://www.cwnp.com/store/products/ALL3SGS.php

Cisco Output Interpreter - New this month Wireless LAN Controller - show & debug commands

 

I wanted to share this in case you may have a use for it. I've used it in the past, its a little hit or miss on what is supported and how the code is sometimes read. It was recently updated to support the Cisco WLCs show & debug commands

Output Interpreter is a troubleshooting tool that reports potential problems by analyzing supported "show" command output. Output Interpreter supports various "show" command output from your router, switch, PIX/ASA firewall, IOS® wireless access point, or Meeting Place Platform.

The Output Interpreter continues to support new features to better serve you. This month's list of new features includes support for GOLD diagnostics and other outputs, including:

• Cisco 12000 IOS XR Firmware, Hardware and Software Readiness Assessment (Up to version 3.8)
• Wireless LAN Controller - show & debug commands
• GOLD diagnostics - show diagnostic result
• ASA Commands - show tech-support, show running-config

https://www.cisco.com/cgi-bin/Support/OutputInterpreter/home.pl 

Autonomous: Disable Cisco AP MODE Button

 

You can disable the MODE button on a Cisco AP. Why do you ask? This command prevents unauthorized users from gaining access to the access point CLI and creating a "inside rogue".

I consulted at a government agency and part of their requirements was to disable all means except console access which also included disabling the MODE button. They feared someone could reset the AP and reconfigure it as a "inside rogue". 

By default the MODE button is enabled.

 

ap#config t

ap(config)#boot mode-button 

 

Negate

ap(config)#no boot mode-button

 

SHOW BOOT

 

ap#show boot

BOOT path-list:

Config file:         flash:/config.txt

Private Config file: flash:/private-config

Enable Break:        no

Manual Boot:         no

Enable IOS Break:    no

HELPER path-list:

NVRAM/Config file

      buffer size:   32768

      Mode Button:    on

 

NOTE:

If you lose the privileged EXEC mode password for the access point after entering this command, you will need to contact the Cisco Technical Assistance Center (TAC) to regain access to the access point CLI.

Autonomous: Reset Cisco Access Point to Factory Defaults Using the MODE Button

 

How to reset a Cisco Autonomous access point using the MODE button.

I have a small project coming up and getting refreshed with the Cisco Autonomous Access Points...

Using the MODE Button

Follow these steps to delete the current configuration and return all access point settings to the factory defaults by using the MODE button:

1. Disconnect power from the access point (the power jack for external power or the Ethernet cable for in-line power).

2. Press and hold the MODE button while you reconnect power to the access point.

3. Continue pressing the MODE button until the Ethernet LED turns amber. (approximately 2 to 3 seconds). Then release the button.

4. After the access point reboots, you must reconfigure it using the web browser interface, the Telnet interface, or the access point console port.

Ascom I62, THE FIRST .11N HANDSET, INTRODUCED AT HIMSS IN ATLANTA

 

Big news out of HIMSS. Ascom  first to market with enterprise 802.11n VoIP handset, Ascom i62.

I've had the pleasure of working with Ascom on a number of projects as a consultant. In fact I participated in the first FREENET deployments when Ascom US first got started and designed and implemented the first Ascom IP Dect system for a large hospital system in the US when it was first released.

Ascom is an innovative company. In fact they were the first to market with the first 802.11g handset (i75) before Cisco, Vocera and Spectralink. This raises the bar yet again for Cisco and Spectralink, respectively.

Looking to get the stats on this device…. Stay tuned!

"Im going to let my Chauffeur answer that...."

 

Math and Physics for the 802.11 Wireless Engineer

I was recently asked by another (wired) engineer for a quick read to get up to speed with RF / 802.11. My answer, "Im going to let my Chauffeur answer that...."

As he gave me the look ... I said,"Ill send you the link"

If you haven't read this classic by Joseph Bardwell what are you waiting for ! This is a great PDF read and its easy on the eyes, well kinda. If you are new to RF / 802.11 this could close some of your learning gaps!

http://www.connect802.com/download/techpubs/2008/my_chauffeur_BD0414.pdf

Cisco Releases WLC code 6.0.196.0

 

Cisco Releases WLC code 6.0.196.0

Resolved Caveats

Caveats resolved in controller software release 6.0.196.0

ID Number	Caveat Title
CSCso38071	AP's do not remain Joined if directly connected to WLC2106
CSCsx70889	Crash due to stack corruption caused by recursive tunnels
CSCsz38828	AMAC radio core dumps: transmitter seems to have stopped
CSCsz75186	tcp crash by watchdog timeout due to tcp options
CSCtb12031	1142 / 1252 inconsistently ACKs Vocera (gen1) badge.
CSCtb13491	Malformed IKE packet may cause reload
CSCtb16583	AP changes from Static IP to DHCP and doesn't covert back to Static
CSCtb52563	WLC 4.2.205.0 crashes at spam_CCM_decrypt+124
CSCtc06925	1250-WGB fails to scan for the uplink when it goes out of wifi zone
CSCtc14910	AP 1140 not joinning WLC and logging tracebacks
CSCtc15696	1250 and 1130 APs flash got erased
CSCtc41293	Controller doesn't act upon receiving ICMP fragmented needed packet
CSCtc52054	AP1130 crash in HAL_A50X driver
CSCtc73414	AP not generating trap during radio UP -> radio DOWN transition
CSCtc83353	Dynamic interface support for RADIUS request and NAS-ID
CSCtd01611	Important TLS/SSL security update
CSCtd17116	Emergency Image Version shows up N/A
CSCtd18702	Max Tx Power in Country IE is incorrect
CSCtd23497	1242 AP HREAP Mode crashes after %CAPWAP-5-CHANGED state to Join
CSCtd34312	5508 Web Auth breaks with multicast MAC as gateway
CSCtd71123	Association failure due to WMM mismatch in AP and WLC
CSCtd84522	Fiber port (gig3) does not create VLAN subinterfaces when bridging
CSCtd91013	memory corruption crash on 5500
CSCte01087	5508 on 6.0.188.0 won't let AP join when on different VLAN than mgmt int
CSCte07702	Rap 1522 crashes periodically
CSCte08161	Cannot get IP address from server if key-management is "wpa optional"
CSCte43508	5508 data plane hang/crash Task Name: osapiReaper
CSCte73125	APs cannot join wism
CSCte90708	Controller crash in emWeb while viewing mac filter table in GUI