 Feedback
|
Table Of Contents
Release Notes for Cisco Wireless LAN Controllers and Lightweight Access Points for Release 3.2.215.0
Cisco Unified Wireless Network Solution Components
Upgrading to a New Software Release
Support for Reusable Static WEP Key Indices
Power-over-Ethernet Parameters
FCC Safety Compliance Statement
Changing the Default Values of SNMP Community Strings
Using the GUI to Change the SNMP Community String Default Values
Using the CLI to Change the SNMP Community String Default Values
Changing the Default Values for SNMP v3 Users
Using the GUI to Change the SNMP v3 User Default Values
Using the CLI to Change the SNMP v3 User Default Values
Controllers Must Run Release 3.2.116.21 or Later to Support -P Regulatory Domain
Operating Mesh Networks Through Switches and Routers
RADIUS Servers and the Management VLAN
Cisco 7920 Wireless IP Phone Support
Exclusion List (Blacklist) Client Feature
Cisco Aironet 1030 Remote Edge Lightweight Access Points and WPA2-PSK
Management Usernames and Local Netuser Names
802.1x and Microsoft Wireless Configuration Manager
Cisco Aironet 1030 Remote Edge Lightweight Access Point Default Operation
Home Page Retains Web Auth Login with IE 5.x
Features Not Supported on 2000 Series Controllers
Some Clients See Only 64 Access Point MAC Addresses (BSSIDs) at a Time
Pinging from Any Network Device to a Dynamic Interface IP Address Is Not Supported
2006 Image Not Supported for 3504 Controllers
Running a 3504 Image on a 2000 Series Controller
Cisco Lightweight Access Points Fail to Join Cisco Controllers
Upgrading External Web Authentication
Obtaining Documentation and Submitting a Service Request
Release Notes for Cisco Wireless LAN Controllers and Lightweight Access Points for Release 3.2.215.0
September 2009These release notes describe new and changed information as well as resolved caveats for operating system release 3.2.215.0 for Cisco 2000, 4100, and 4400 Series Wireless LAN Controllers; Cisco Wireless Services Modules (WiSM); Cisco Wireless LAN Controller Network Modules; and Cisco Aironet 1000, 1130, 1200, 1240, and 1500 Series Lightweight Access Points, which comprise part of the Cisco Unified Wireless Network (Cisco UWN) Solution.
Note
Unless otherwise noted, all of the Cisco wireless LAN controllers are hereafter referred to as controllers, and all of the Cisco lightweight access points are hereafter referred to as access points.
Contents
These release notes contain the following sections:
•
Cisco Unified Wireless Network Solution Components
The following components are part of the Cisco UWN Solution and are compatible in this release:
•
•
•
•
•
•
•
•
Note
Controller Requirements
The controller graphical user interface (GUI) requires the following operating system and web browser:
•
•
Note
Software Release Information
Operating system software is factory installed on your controller and automatically downloaded to the access points after a release upgrade and whenever an access point associates to a controller. As new releases become available for the controllers and their associated access points, consider upgrading.
Note
Finding the Software Release
To find the software release running on your controller, look on the Monitor > Summary page of the controller GUI or enter show sysinfo on the controller command line interface (CLI).
Upgrading to a New Software Release
When a controller is upgraded, the code on its associated access points is also automatically upgraded. When an access point is loading code, each of its lights blinks in succession.
Caution
Cisco recommends the following sequence when performing an upgrade:
1.
2.
3.
http://www.cisco.com/en/US/products/ps6366/products_installation_and_configuration_guides_list.html
4.
Note
New and Changed Information
Image Load Protection
When you download a new controller image, a check is performed to ensure that the image being loaded is meant for the current controller. If you attempt to install an incorrect image, the install aborts, and an error message appears.
Support for Per-WLAN ACLs
Access control lists (ACLs) can be applied to WLANs as well as interfaces. ACLs are applied in the following order:
•
•
•
You can apply an ACL to a WLAN only through the controller CLI. To do so, enter this command:
config wlan acl
Support for Reusable Static WEP Key Indices
The same static WEP key index can be configured for multiple WLANs.
Power-over-Ethernet Parameters
Controller software supports power-over-Ethernet (PoE), also known as inline power, parameters for the AP1131 and the AP1242 in the controller GUI. To access these parameters, click Wireless and then the Detail link of the desired access point. The new parameters appear on the All APs > Details page under Power Over Ethernet Settings.
These parameters enable you to configure inline power and power injector settings for an AP1131 or AP1242:
•
–
–
–
–
–
–
–
–
Do not check this check box if power is being provided by a power injector or by a switch not on this list.
•
•
–
Note
–
–
Installation Notes
This section contains important information to keep in mind when installing your controllers and access points.
Warnings
Warning
Warning
Warning
Warning
Warning
WarningSafety Information
Follow the guidelines in this section to ensure proper operation and safe use of the controllers and access points.
FCC Safety Compliance Statement
FCC Compliance with its action in ET Docket 96-8, has adopted a safety standard for human exposure to RF electromagnetic energy emitted by FCC certified equipment. When used with approved Cisco Aironet antennas, Cisco Aironet products meet the uncontrolled environmental limits found in OET-65 and ANSI C95.1, 1991. Proper operation of this radio device according to the instructions in this publication results in user exposure substantially below the FCC recommended limits.
Safety Precautions
Each year hundreds of people are killed or injured when attempting to install an antenna. In many of these cases, the victim was aware of the danger of electrocution but did not take adequate steps to avoid the hazard.
For your safety, and to help you achieve a good installation, read and follow these safety precautions. They may save your life!
1.
2.
3.
4.
5.
a.
b.
c.
6.
7.
8.
Installation Instructions
Refer to the appropriate Quick Start Guide or Hardware Installation Guide for instructions on installing your controllers and access points.
Note
Personnel installing the controllers and access points must understand wireless techniques and grounding methods. Access points with internal antennas can be installed by an experienced IT professional.
The controller must be installed by a network administrator or qualified IT professional, and the proper country code must be selected. Following installation, access to the controller should be password protected by the installer to maintain compliance with regulatory requirements and ensure proper unit functionality.
Important Notes
This section describes important information about the controllers and access points.
Changing the Default Values of SNMP Community Strings
The controller has commonly known default values of "public" and "private" for the read-only and read-write SNMP community strings. Using these standard values presents a security risk. Therefore, Cisco strongly advises that you change these values.
Using the GUI to Change the SNMP Community String Default Values
Follow these steps to change the SNMP community string default values through the controller GUI.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Using the CLI to Change the SNMP Community String Default Values
Follow these steps to change the SNMP community string default values through the controller CLI.
Step 1
show snmp community
Step 2
config snmp community delete name
The name parameter is the community name (in this case, "public" or "private").
Step 3
config snmp community create name
Enter up to 16 alphanumeric characters for the name parameter. Do not enter "public" or "private."
Step 4
config snmp community ipaddr ip_address ip_mask name
Step 5
config snmp community accessmode {ro | rw} name
Step 6
config snmp community mode {enable | disable} name
Step 7
Step 8
Changing the Default Values for SNMP v3 Users
The controller uses a default value of "default" for the username, authentication password, and privacy password for SNMP v3 users. Using these standard values presents a security risk. Therefore, Cisco strongly advises that you change these values.
Using the GUI to Change the SNMP v3 User Default Values
Follow these steps to change the SNMP v3 user default values through the controller GUI.
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Using the CLI to Change the SNMP v3 User Default Values
Follow these steps to change the SNMP v3 user default values through the controller CLI.
Step 1
show snmpv3user
Step 2
config snmp v3user delete username
The username parameter is the SNMP v3 username (in this case, "default").
Step 3
config snmp v3user create username {ro | rw} {none | hmacmd5 | hmacsha} {none | des} auth_password privacy_password
where
•
•
•
•
•
•
Do not enter "default" for the username and password parameters.
Step 4
FIPS 140-2
The Cisco 4400 Series Controllers are on the NIST FIPS 140-2 Pre-Validation List.
L2TP Not Supported
Software release 3.2.215.0 does not support L2TP. If you upgrade to this release from a previous release that supported L2TP, any WLANs that are configured for that feature become disabled. If you want to use L2TP you must use a version of controller software prior to 3.2 or wait for the next 3.2 release.
Controllers Must Run Release 3.2.116.21 or Later to Support -P Regulatory Domain
To support access points configured for use in Japan, you must upgrade the controller software to release 3.2.116.21 or later. Earlier releases do not support access points configured for use in Japan (regulatory domain -P).
Voice WLAN Configuration
Cisco recommends that load balancing always be turned off in any wireless LAN that is supporting voice, regardless of vendor. When load balancing is turned on, voice clients can hear an audible artifact when roaming, and the handset is refused at its first reassociation attempt.
Inter-Subnet Roaming
Currently, multicast traffic cannot be passed during inter-subnet roaming.
Operating Mesh Networks Through Switches and Routers
In mesh networks that operate through low-speed switches and routers, access points can disconnect from the controller, causing the controller to generate alerts.
Heavily Loaded Controller CPU
When the controller CPU is heavily loaded (for example, when doing file copies or other tasks), it does not have time to process all of the ACKs that the NPU sends in response to configuration messages. When this happens, the CPU generates error messages. However, the error messages do not impact service or functionality.
RADIUS Servers and the Management VLAN
The RADIUS server can be on any subnet as long as it can be reached by the management VLAN subnet.
The controllers can be managed via the management VLAN subnet from any other subnet that can reach the management VLAN subnet.
Cisco 7920 Wireless IP Phone Support
When using Cisco 7920 Wireless IP Phones with controllers, make sure that the phones and controllers are configured as follows:
•
•
–
Note
–
–
–
–
Note
–
•
•
•
Client Channel Changes
Cisco access points are known to go off channel for up to 30 seconds while identifying rogue access point threats. This activity can cause occasional dropped client connections.
Exclusion List (Blacklist) Client Feature
If a client is not able to connect to an access point and the security policy for the WLAN and/or client is correct, the client has probably been disabled. In the controller GUI, you can view the client's status on the Monitor > Summary page under Client Summary. If the client is disabled, click Remove to clear the disabled state for that client. The client automatically comes back and, if necessary, reattempts authentication.
Automatic disabling happens as a result of too many failed authentications. Clients disabled due to failed authorization do not appear on the permanent disable display. This display is only for those MACs that are set as permanently disabled by the administrator.
Maximum MAC Filter Entries
The controller database can contain up to 2048 MAC filter entries for local netusers. The default value is 512. To support up to 2048 entries, you must enter this command in the controller CLI:
config database size MAC_filter_entry
where MAC_filter_entry is a value from 512 to 2048.
Cisco Aironet 1030 Remote Edge Lightweight Access Points and WPA2-PSK
Cisco Aironet 1030 Remote Edge Lightweight Access Points do not support WPA2-PSK in REAP standalone mode.
RADIUS Servers
This product has been tested with the following RADIUS servers:
•
•
•
•
Management Usernames and Local Netuser Names
Management usernames and local netuser names must be unique because they are stored in the same database. That is, you cannot assign the same name to a management user and a local netuser.
802.1x and Microsoft Wireless Configuration Manager
Clients using the Microsoft Wireless Configuration Manager and 802.1x must use WLANs configured for 40- or 104-bit key length. Configuring for 128-bit key length results in clients that can associate but not authenticate.
Cisco Aironet 1030 Remote Edge Lightweight Access Point Default Operation
When a controller reboots, dropped Cisco Aironet 1030 Remote Edge Lightweight Access Points attempt to associate to any available controller. If the access points cannot contact a controller, they continue to offer 802.11a/b/g service on WLAN 1 only.
Using the Backup Image
The controller bootloader (ppcboot) stores a copy of the active primary image and the backup image. If the primary image becomes corrupted, you can use the bootloader to boot with the backup image.
With the backup image stored before rebooting, be sure to choose Option 4: Change Active Boot Image from the boot menu to set the backup image as the active boot image. Otherwise, when the controller resets, it again boots off the corrupted primary image.
After the controller boots, the active boot image can be changed to the backup image using the config boot backup command.
Home Page Retains Web Auth Login with IE 5.x
Due to a caching issue in the Internet Explorer 5.x browser, the home page retains the web authentication login. To correct this issue, clear the history or upgrade your workstation to Internet Explorer 6.x.
Ad-Hoc Rogue Containment
Client card implementations may mitigate the effectiveness of ad hoc containment.
RLDP Enable/Disable
The RLDP protocol detects rogues on your wired network. When RLDP is enabled, the controller reports a threat alarm for each rogue detected on the wired network. When RLDP is disabled, rogues detected on the wired network are shown in the Alert state.
Disabling RLDP stops the controller from detecting rogues on the wired network. Rogues can be manually contained by changing the status of the detected rogues. When rogues are being contained, you must manually disable containment for each rogue individually.
Apple iBook
Some Apple operating systems require shared key authentication for WEP. Other releases of the operating system do not work with shared key WEP unless the client saves the key in its key ring. How you should configure your controller is based on the client mix you expect to use. Cisco recommends testing these configurations before deployment.
Features Not Supported on 2000 Series Controllers
These hardware features are not supported on 2000 series controllers:
•
•
These software features are not supported on 2000 series controllers:
•
•
•
•
•
•
•
•
•
•
•
Some Clients See Only 64 Access Point MAC Addresses (BSSIDs) at a Time
In a crowded RF environment, clients may not be able to detect the desired SSID because of internal table limitations. Sometimes disabling and then enabling the client interface forces a rescan. Your RF environment needs to be controlled. Cisco UWN rogue access point detection and containment can help you to enforce RF policies in your buildings and campuses.
Pinging from Any Network Device to a Dynamic Interface IP Address Is Not Supported
Clients on the WLAN associated with the interface pass traffic normally.
2006 Image Not Supported for 3504 Controllers
The 2006 controller image is supported for use with only 2000 series controllers. Do not install the 2006 image on a 3504 controller. Otherwise, errors may occur. Install only the 3504 image on a 3504 controller.
Running a 3504 Image on a 2000 Series Controller
It is possible to run a 3504 controller image on a 2000 series controller, but Cisco Aironet 1130, 1200, and 1240 series access points will not be able to connect to the controller.
Cisco Lightweight Access Points Fail to Join Cisco Controllers
When a Cisco lightweight access point is connected to a terminal server port and reboots because of a join failure or timeout, this sequence repeats until the access point returns to the boot prompt and remains there. This condition occurs when there is no telnet session to the access point's console port and when the controller is not responding to the access point's join response.
Workaround: Disconnect the access point's console port from the terminal server. Reprogram the controller to have it respond to the access point's join request. Power cycle the access point to force a restart.
Upgrading External Web Authentication
When upgrading a controller from operating system release 2.0 or 2.2.127.4 to release 3.2.116.21 or later, update the external web authentication configuration as follows:
1.
config custom-web ext-webserver add IP-address
Note
2.
<html><head><meta http-equiv="Pragma" content="no-cache"> <meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <title>Web Authentication</title> <script>function submitAction(){var link = document.location.href;var searchString = "redirect=";var equalIndex = link.indexOf(searchString);var redirectUrl = "";var urlStr = "";if(equalIndex > 0) {equalIndex += searchString.length;urlStr = link.substring(equalIndex);if(urlStr.length > 0){redirectUrl += urlStr;if(redirectUrl.length > 255)redirectUrl = redirectUrl.substring(0,255);document.forms[0].redirect_url.value = redirectUrl;}}document.forms[0].buttonClicked.value = 4;document.forms[0].submit();}function loadAction(){var url = window.location.href;var args = new Object();var query = location.search.substring(1);var pairs = query.split("&");for(var i=0;i<pairs.length;i++){var pos = pairs[i].indexOf('=');if(pos == -1) continue;var argname = pairs[i].substring(0,pos);var value = pairs[i].substring(pos+1);args[argname] = unescape(value);}//alert( "AP MAC Address is " + args.ap_mac);//alert( "The Switch URL is " + args.switch_url);document.forms[0].action = args.switch_url;// This is the status code returned from webauth login action// Any value of status code from 1 to 5 is error condition and user// should be shown error as below or modify the message as it suits// the customerif(args.statusCode == 1){alert("You are already logged in. No further action is required on your part.");}else if(args.statusCode == 2){alert("You are not configured to authenticate against web portal. No further action is required on your part.");}else if(args.statusCode == 3){alert("The username specified cannot be used at this time. Perhaps the user is already logged into the system?");}else if(args.statusCode == 4){alert("Wrong username and password. Please try again.");}else if(args.statusCode == 5){alert("The User Name and Password combination you have entered is invalid. Please try again.");}}</script></head><body topmargin="50" marginheight="50" onload="loadAction();"> <form method="post"> <input TYPE="hidden" NAME="buttonClicked" SIZE="16" MAXLENGTH="15" value="0"> <input TYPE="hidden" NAME="redirect_url" SIZE="255" MAXLENGTH="255" VALUE=""> <input TYPE="hidden" NAME="err_flag" SIZE="16" MAXLENGTH="15" value="0"><div align="center"><table border="0" cellspacing="0" cellpadding="0"> <tr> <td> </td></tr><tr align="center"> <td colspan="2"><font size="10" color="#336699">Web Authentication</font></td></tr><tr align="center"><td colspan="2"> User Name <input type="TEXT" name="username" SIZE="25" MAXLENGTH="63" VALUE=""> </td> </tr> <tr align="center" > <td colspan="2"> Password <input type="Password" name="password" SIZE="25" MAXLENGTH="24"> </td> </tr><tr align="center"><td colspan="2"><input type="button" name="Submit" value="Submit" class="button" onclick="submitAction();"> </td> </tr> </table> </div></form></body></html>Caveats
This section lists resolved and closed caveats in operating system release 3.2.215.0 for Cisco controllers and lightweight access points.
Resolved Caveats
These caveats are resolved in operating system release 3.2.215.0:
•
http://www.cisco.com/en/US/products/csr/cisco-sr-20090114-http.html
•
–
–
These vulnerabilities are independent of each other. Cisco has released free software updates that address these vulnerabilities. There are no workarounds available for these vulnerabilities.
The advisory is posted at http://www.cisco.com/en/US/products/csa/cisco-sa-20090204-wlc.html
•
–
–
These vulnerabilities are independent of each other. Cisco has released free software updates that address these vulnerabilities. There are no workarounds available for these vulnerabilities.
The advisory is posted at http://www.cisco.com/en/US/products/csa/cisco-sa-20090204-wlc.html
•
–
–
These vulnerabilities are independent of each other. Cisco has released free software updates that address these vulnerabilities. There are no workarounds available for these vulnerabilities.
This advisory is posted at http://www.cisco.com/en/US/products/csa/cisco-sa-20090204-wlc.html.
•
http://www.cisco.com/en/US/products/csr/cisco-sr-20090114-http.html
•
•
–
–
–
–
Cisco has released free software updates that address these vulnerabilities. This advisory is posted at http://www.cisco.com/en/US/products/csa/cisco-sa-20090727-wlc.html.
•
–
–
–
–
Cisco has released free software updates that address these vulnerabilities. This advisory is posted at http://www.cisco.com/en/US/products/csa/cisco-sa-20090727-wlc.html.
•
•
–
–
–
–
Cisco has released free software updates that address these vulnerabilities. This advisory is posted at
http://www.cisco.com/en/US/products/csa/cisco-sa-20090727-wlc.html.
•
–
–
–
–
Cisco has released free software updates that address these vulnerabilities. This advisory is posted at http://www.cisco.com/en/US/products/csa/cisco-sa-20090727-wlc.html.
Troubleshooting
For the most up-to-date, detailed troubleshooting information, refer to the Cisco TAC website at
http://www.cisco.com/cisco/web/support/index.html.
Click Product Support > Wireless. Then choose your product and Troubleshooting to find information on the problem you are experiencing.
Related Documentation
For additional information on the Cisco controllers and lightweight access points, refer to these documents:
•
•
•
•
•
•
Click this link to browse to the Cisco Support and Documentation page:
http://www.cisco.com/cisco/web/support/index.html
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flip Video, Flip Video (Design), Flipshare (Design), Flip Ultra, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0907R)
© 2009 Cisco Systems, Inc. All rights reserved.
