 Feedback
|
Table Of Contents
Release Notes for Cisco Wireless LAN Controllers and Lightweight Access Points for Release 4.2.209.0
Cisco Unified Wireless Network Solution Components
Special Notice for Mesh Networks
Upgrading to a New Software Release
Special Rules for Upgrading to Controller Software Release 4.2.209.0
FCC Safety Compliance Statement
ARP Requests Sometimes Fail for Access Points Connected Directly to
2006 and 2100 Series ControllersOne-Time Password (OTP) Support
Crash Files for 1250 Series Access Points
Port Mirroring Not Supported on Some Controller Platforms
Configuration File Stored in XML Format
40-MHz Channels in the 2.4-GHz Band
Impact of External Antenna Gain on Transmit Power
Supporting Oversized Access Point Images
Cisco 1250 Series Access Points and Cisco 7920 IP Phones
MAC Filtering for WGB Wired Clients
CKIP Not Supported with Dynamic WEP
Synchronizing the Controller and Location Appliance
UNII-2 Channels Disabled on New 1000 Series Access Points for United States, Canada, and Philippines
FCC DFS Support on 1130 Series Access Points
Inaccurate Transmit Power Display
Setting the Retransmit Timeout Value for TACACS+ Servers
Configuring an Access Point's Prestandard Power Setting
1000 Series Access Points and Radar Detection
Controller Functions that Require a Reboot
Resetting the Configuration on 2006 Controllers
Rate-Limiting on the Controller
Pings Supported to the Management Interface of the Controller
Pinging from a Network Device to a Controller Dynamic Interface
4400 Series Controllers Do Not Forward Subnet Broadcasts through Guest Tunnel
Connecting 1100 and 1300 Series Access Points
Preventing Clients from Accessing the Management Network on a Controller
Voice Wireless LAN Configuration
Changing the IOS LWAPP Access Point Password
Exclusion List (Blacklist) Client Feature
RADIUS Servers and the Management VLAN
Cisco 1000 Series Access Points and WMM
Cisco Aironet 1030 Remote Edge Lightweight Access Points and WPA2-PSK
Lightweight Access Point Connection Limitations
Management Usernames and Local Netuser Names
802.1X and Microsoft Wireless Configuration Manager
Home Page Retains Web Authentication Login with IE 5.x
Rogue Location Discovery Protocol (RLDP)
Changing the Default Values of SNMP Community Strings
Changing the Default Values for SNMP v3 Users
Features Not Supported on 2000 and 2100 Series Controllers
Some Clients See Only 64 Access Point MAC Addresses (BSSIDs) at a Time
2006 Image Not Supported for 3504 Controllers
Running a 3504 Image on a 2000 Series Controller
Upgrading External Web Authentication
Obtaining Documentation, Support, and Security Guidelines
Release Notes for Cisco Wireless LAN Controllers and Lightweight Access Points for Release 4.2.209.0
May, 2010
These release notes describe open and resolved caveats for software release 4.2.209.0 for Cisco 2000, 2100, and 4400 Series Wireless LAN Controllers; Cisco Wireless Services Modules (WiSM); Cisco Wireless LAN Controller Network Modules; Catalyst 3750G Integrated Wireless LAN Controller Switches; Cisco 3201 Wireless Mobile Interface Cards (WMICs); and Cisco Aironet 1000, 1100, 1130, 1200, 1230AG, 1240, 1250, and 1300 Series Lightweight Access Points, which comprise part of the Cisco Unified Wireless Network (UWN) Solution.
Note
Unless otherwise noted, all of the Cisco wireless LAN controllers are hereafter referred to as controllers, and all of the Cisco lightweight access points are hereafter referred to as access points.
Contents
These release notes contain the following sections.
•
•
Cisco Unified Wireless Network Solution Components
The following components are part of the Cisco UWN Solution and are compatible in this release:
•
•
•
Note
•
•
•
•
•
•
•
•
•
•
•
Note
Note
Special Notice for Mesh Networks
Note
Note
Controller Requirements
The controller GUI requires the following operating system and web browser:
•
•
Note
Software Release Information
Software is factory installed on your controller and automatically downloaded to the access points after a release upgrade and whenever an access point joins a controller. As new releases become available for the controllers and their access points, consider upgrading.
Note
Note
Note
Note
Finding the Software Release
To find the software release running on your controller, click Monitor and look at the Software Version field under Controller Summary on the controller GUI or enter show sysinfo on the controller CLI.
Upgrading to a New Software Release
When you upgrade the controller's software, the software on the controller's associated access points is also automatically upgraded. When an access point is loading software, each of its LEDs blinks in succession. Up to 10 access points can be concurrently upgraded from the controller.
Note
Caution
Special Rules for Upgrading to Controller Software Release 4.2.209.0
Caution
•
–
–
–
–
•
Note
•
Note
Note
Caution
Note
Follow these steps to upgrade the controller software using the controller GUI.
Step 1
Note
Step 2
a.
http://www.cisco.com/cisco/software/navigator.html
b.
c.
d.
e.
f.
g.
h.
i.
•
•
•
j.
k.
l.
m.
n.
o.
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
Step 14
Step 15
Step 16
Step 17
Note
Installation Notes
This section contains important information to keep in mind when installing controllers and access points.
Warnings
Warning
Warning
Warning
Warning
Warning
Warning
Warning
Warning
Warning
Warning
Safety Information
Follow the guidelines in this section to ensure proper operation and safe use of the controllers and access points.
FCC Safety Compliance Statement
FCC Compliance with its action in ET Docket 96-8, has adopted a safety standard for human exposure to RF electromagnetic energy emitted by FCC-certified equipment. When used with approved Cisco Aironet antennas, Cisco Aironet products meet the uncontrolled environmental limits found in OET-65 and ANSI C95.1, 1991. Proper operation of this radio device according to the instructions in this publication results in user exposure substantially below the FCC recommended limits.
Safety Precautions
Each year hundreds of people are killed or injured when attempting to install an antenna. In many of these cases, the victim was aware of the danger of electrocution but did not take adequate steps to avoid the hazard.
For your safety, and to help you achieve a good installation, read and follow these safety precautions. They may save your life!
1.
2.
3.
4.
5.
a.
b.
c.
6.
7.
8.
Installation Instructions
Refer to the appropriate quick start guide or hardware installation guide for instructions on installing controllers and access points.
Note
Personnel installing the controllers and access points must understand wireless techniques and grounding methods. Access points with internal antennas can be installed by an experienced IT professional.
The controller must be installed by a network administrator or qualified IT professional, and the proper country code must be selected. Following installation, access to the controller should be password protected by the installer to maintain compliance with regulatory requirements and ensure proper unit functionality.
Important Notes
This section describes important information about the controllers and access points.
ARP Requests Sometimes Fail for Access Points Connected Directly to
2006 and 2100 Series ControllersCisco 2006 and 2100 series controllers do not support ARP requests from access points connected directly to a port on the controller unless there is an interface configured on that controller port. ARP requests from the access point cannot reach the gateway on the interface VLAN and the access point might lose its connection to the controller.
To work around this limitation, configure the access point's default gateway to match the controller's management IP address, or connect the access point to a switch port between the access point and the controller.
One-Time Password (OTP) Support
One Time Passwords (OTP) are supported on the Wireless Lan Controller (WLC) using TACACS and RADIUS. In this configuration, the controller acts as a transparent pass-thru device. The controller forwards all client requests to the TACACS/RADIUS server without inspecting the client behavior. When using OTP the client must only establish a single connection to the controller to function properly. The controller currently does not have any intelligence or checks to correct a client that is trying to establish multiple connections.
QoS Interaction with RRM
Controller software release 4.2.205.0 or later affects the way that QoS interacts with the RRM scan defer feature:
•
•
•
If you completely disable off-channel scanning on your network, you should consider alternative ways to implement off-channel scanning: adding monitor-mode access points or creating AP groups where some access points in the area do not carry the configured WLANs for those devices.
Crash Files for 1250 Series Access Points
The 1250 series access points may contain a bootloader older than version 12.4(10b)JA. Units with old bootloaders do not generate a crash log when a crash occurs. The crash log is disabled so that a crash does not corrupt the flash file system. Units with bootloader versions 12.4(10b)JA or later generate a crash log if the access point is associated to a controller software release 4.2.112.0 or later.
New 1250 series access points shipped from the factory contain new bootloader images, which fixes the flash file system after it is corrupted during a crash (without losing files). This new bootloader automatically sets a new CRASH_LOG environment variable to "yes," which enables a crash log to be generated following a crash but only on controllers running software release 4.2.112.0 or later. Therefore, no user configuration is needed to enable a crash log on new 1250 series access points shipped from the factory.
These examples show the output from the CLI commands (in bold) that you use to check the bootloader version on LWAPP and autonomous 1250 series access points:
LWAPP (commands entered on the controller CLI):
(wlc) >debug ap enable AP001b.d513.1754(wlc) >debug ap command "show version | include BOOTLDR" AP001b.d513.1754(wlc) >Thu Apr 23 09:31:38 2009: AP001b.d513.1754: BOOTLDR: C1250 Boot Loader (C1250-BOOT-M) Version 12.4(10b)JA, RELEASE SOFTWARE (fc1)Autonomous (command entered on the access point CLI):
ap# show version | include BOOTLDRBOOTLDR: C1250 Boot Loader (C1250-BOOT-M) Version 12.4(10b)JA, RELEASE SOFTWARE (fc1)Port Mirroring Not Supported on Some Controller Platforms
The controller port mirroring feature is not supported on 2100 series controllers, 4400 series controllers, Cisco WiSM controllers, and controller network modules.
Internal DHCP Server
When clients use the controller's internal DHCP server, IP addresses are not preserved across reboots. As a result, multiple clients can be assigned the same IP address. To resolve any IP address conflicts, clients must release their existing IP address and request a new one.
RLDP Limitations
Rogue Location Discovery Protocol (RLDP) is a controller feature that detects the presence of rogue access points that are connected to your wired network. RLDP operates with these limitations:
•
•
•
•
•
Configuration File Stored in XML Format
In controller software 4.2, the controller's bootup configuration file is stored in an Extensible Markup Language (XML) format rather than in binary format. Therefore, you cannot download a binary configuration file onto a controller running software release 4.2. However, when you upgrade a controller from a previous software release to 4.2, the configuration file is migrated and converted to XML.
Web Authentication Redirects
The controller supports web authentication redirects only to HTTP (HTTP over TCP) servers. It does not support web authentication redirects to HTTPS (HTTP over SSL) servers.
Disabling Radio Bands
The controller disables the radio bands that are not permitted by the configured country of operation (CSCsi48220).
40-MHz Channels in the 2.4-GHz Band
Cisco recommends that you do not configure 40-MHz channels in the 2.4-GHz radio band because severe co-channel interference is likely to occur.
Impact of External Antenna Gain on Transmit Power
In controller software release 4.2 or later, external antenna gain is factored into the maximum transmit power of the access point. Therefore, when you upgrade from an earlier software release to 4.2 or later, you might see a decrease in transmit power output.
Supporting Oversized Access Point Images
Controller software release 4.2 or later allows you to upgrade to an oversized access point image by deleting the recovery image to create sufficient space. This feature affects only access points with 8 MB of flash (the 1100, 1200, and 1310 series access points). All newer access points have a larger flash size than 8 MB.
Note
The recovery image provides a backup image that can be used if an access point power-cycles during an image upgrade. The best way to avoid the need for access point recovery is to prevent an access point from power-cycling during a system upgrade. If a power-cycle occurs during an upgrade to an oversized access point image, you can recover the access point using the TFTP recovery procedure.
Follow these steps to perform the TFTP recovery procedure.
Step 1
Step 2
Step 3
Cisco 1250 Series Access Points and Cisco 7920 IP Phones
Cisco 1250 series access points are not supported for use with the Cisco 7920 IP phone. They can, however, be used with the Cisco 7921 and 7925 IP phones.
Multicast Limitations
Multicast is not supported on access points that are connected directly to the local port of a 2000 or 2100 series controller.
MAC Filtering for WGB Wired Clients
Controller software release 4.1.178.0 or later enables you to configure a MAC-filtering IP address for a workgroup bridge (WGB) wired client to allow passive WGB wired clients, such as terminal servers or printers with static IP addresses, to be added and remain in the controller's client table while the WGB is associated to a controller in the mobility group. This feature, activated by the config macfilter ipaddress MAC_address IP_address CLI command, can be used with any passive device that does not initiate any traffic but waits for another device to start communication.
This feature allows the controller to learn the IP address of a passive WGB wired client when the WGB sends an IAPP message to the controller that contains only the WGB wired client's MAC address. Upon receiving this message from the WGB, the controller checks the local MAC filter list (or the anchor controller's MAC filter list if the WGB has roamed) for the client's MAC address. If an entry is found and it contains an IP address for the client, the controller adds the client to the controller's client table.
Note
Note
CKIP Not Supported with Dynamic WEP
In controller software release 4.1.185.0 or later, CKIP is supported for use only with static WEP. It is not supported for use with dynamic WEP. Therefore, a wireless client that is configured to use CKIP with dynamic WEP is unable to associate to a wireless LAN that is configured for CKIP. Cisco recommends that you use either dynamic WEP without CKIP (which is less secure) or WPA/WPA2 with TKIP or AES (which are more secure).
Synchronizing the Controller and Location Appliance
For controller software release 4.2 or later, if a location appliance (release 3.1 or later) is installed on your network, the time zone must be set on the controller to ensure proper synchronization between the two systems. Also, Cisco highly recommends that the time be set for networks that do not have location appliances. Refer to Chapter 4 of the Cisco Wireless LAN Controller Configuration Guide, Release 4.2 for instructions for setting the time and date on the controller.
Note
Note
UNII-2 Channels Disabled on New 1000 Series Access Points for United States, Canada, and Philippines
New Cisco 1000 series lightweight access points for the United States, Canada, and the Philippines do not support the UNII-2 band (5.25 to 5.35 GHz). These models are labeled AP10x0-B, where "B" represents a new regulatory domain that replaces the previous "A" domain.
FCC DFS Support on 1130 Series Access Points
Federal Communications Commission (FCC) dynamic frequency selection (DFS) is supported only on 1130 series access points in the United States, Canada, and the Philippines that have a new FCC ID. Access points use DFS to detect radar signals such as military and weather sources and then switch channels to avoid interfering with them. 1130 series access points with FCC DFS support have an FCC ID LDK102054E sticker. 1130 series access points without FCC DFS support have an LDK102054 (no E suffix) sticker. 1130 series access points that are operating in the United States, Canada, or the Philippines; have an FCC ID E sticker; and are running the 4.1.171.0 software release or later can use channels 100 through 140 in the UNII-2 band.
Inaccurate Transmit Power Display
After you change the position of the 802.11a radio antenna for a lightweight 1200 or 1230 series access point, the power setting is not updated in the controller GUI and CLI. Regardless of the user display, the internal data is updated, and the transmit power output is changed accordingly. To see the correct transmit power display values, reboot the access point after changing the antenna's position. (CSCsf02280)
Setting the Retransmit Timeout Value for TACACS+ Servers
Cisco recommends that the retransmit timeout value for TACACS+ authentication, authorization, and accounting servers be increased if you experience repeated reauthentication attempts or the controller falls back to the backup server when the primary server is active and reachable. The default retransmit timeout value is 2 seconds and can be increased to a maximum of 30 seconds.
Configuring an Access Point's Prestandard Power Setting
An access point can be powered by a Cisco prestandard 15-watt switch with Power over Ethernet (PoE) by entering this command:
config ap power pre-standard {enable | disable} {all | Cisco_AP}
A Cisco prestandard 15-watt switch does not support intelligent power management (IPM) but does have sufficient power for a standard access point. The following Cisco prestandard 15-watt switches are available:
•
•
•
•
•
•
•
•
•
The enable version of this command is required for full functionality when the access point is powered by a Cisco prestandard 15-watt switch. It is safe to use if the access point is powered by either an IPM switch or a power injector or if the access point is not using one of the 15-watt switches listed above.
You might need this command if your radio operational status is "Down" when you expect it to be "Up." Enter the show msglog command to look for this error message, which indicates a PoE problem:
Apr 13 09:08:24.986 spam_lrad.c:2262 LWAPP-3-MSGTAG041: AP 00:14:f1:af:f3:40 is unable to verify sufficient in-line power. Radio slot 0 disabled.1000 Series Access Points and Radar Detection
The 1000 series access points perform radar detection on channels that do not require it (such as channel 36). If the access points detect radar on these channels, the controller captures it in log messages.
Controller Functions that Require a Reboot
After you perform these functions on the controller, you must reboot the controller in order for them to take effect:
•
•
•
•
•
config mobility secure-mode {enable | disable}
Multicast Queue Depth
The multicast queue depth is 512 packets on all controller platforms. However, the following message might appear on 2006 and 2106 controllers: "Rx Multicast Queue is full on Controller." This message does not appear on 4400 series controllers because the 4400 NPU filters ARP packets, and all forwarding (multicast or otherwise) and multicast replication are done in the software on the 2006 and 2106.
This message appears when too many multicast messages are sent to the CPU. In controller software releases prior to 5.1, multicast, CDP, and ARP packets share the same queue. However, in software releases 5.1 and later, these packets are separated into different queues. There are currently no controller commands that can be entered to determine if the multicast receive queue is full. When the queue is full, some packets are randomly discarded.
2106 Controller LEDs
The 2106 controller's Status LED and AP LED do not flash amber when software is being uploaded to the controller or downloaded to an access point, respectively.
Note
Resetting the Configuration on 2006 Controllers
If you wish to reset the configuration to factory defaults on a 2006 controller, perform one of the following:
•
•
•
Caution
Rate-Limiting on the Controller
Rate-limiting is applicable to all traffic destined to the CPU from either direction (wireless or wired). Cisco recommends that you always run the controller with the default config advanced rate enable command in effect in order to rate-limit traffic to the controller and protect against denial-of-service (DoS) attacks. You can use the config advanced rate disable command to stop rate-limiting of Internet Control Message Protocol (ICMP) echo responses for testing purposes. However, Cisco recommends that you reapply the config advanced rate enable command after testing is complete.
Pings Supported to the Management Interface of the Controller
Controller software release 4.1.185.0 or later is designed to support ICMP pings to the management interface either from a wireless client or a wired host. ICMP pings to other interfaces configured on the controller are not supported.
Pinging from a Network Device to a Controller Dynamic Interface
Pinging from a network device to a controller dynamic interface may not work in some configurations. When pinging does operate successfully, the controller places Internet Control Message Protocol (ICMP) traffic in a low-priority queue, and the reply to ping is on best effort. Pinging does not pose a security threat to the network. The controller rate limits any traffic to the CPU, and flooding the controller is prevented. Clients on the WLAN associated with the interface pass traffic normally.
GLBP Not Supported
Controller software release 4.2 or later is not compatible with the Gateway Load Balancing Protocol (GLBP). Make sure to configure the controller's default gateway to a fixed address and not to the GLBP virtual address.
IPSec Not Supported
Software release 4.2 does not allow you to choose IPSec as a Layer 3 security option. None and VPN Passthrough are the only available options. If you upgrade to this release from a previous release that supported IPSec as a Layer 3 security option, any WLANs that are configured for this feature become disabled. If you want to configure IPSec, you must use a version of controller software prior to 4.0.
4400 Series Controllers Do Not Forward Subnet Broadcasts through Guest Tunnel
As designed, 4400 series controllers do not forward IP subnet broadcasts from the wired network to wireless clients across the EoIP guest tunnel.
Connecting 1100 and 1300 Series Access Points
You must install software release 4.0.179.8 or later on the controller before connecting 1100 and 1300 series access points to the controller.
Preventing Clients from Accessing the Management Network on a Controller
To prevent or block a wired or wireless client from accessing the management network on a controller (from the wireless client dynamic interface or VLAN), the network administrator should ensure that there is no route through which to reach the controller from the dynamic interface or use a firewall between the client dynamic interface and the management network.
Voice Wireless LAN Configuration
Cisco recommends that aggressive load balancing always be turned off either through the controller GUI or CLI in any wireless network that is supporting voice, regardless of vendor. When aggressive load balancing is turned on, voice clients can hear an audible artifact when roaming, and the handset is refused at its first reassociation attempt.
Changing the IOS LWAPP Access Point Password
Cisco IOS Lightweight Access Point Protocol (LWAPP) access points have a default password of Cisco, and the pre-stage configuration for LWAPP access points is disabled by default. To enable it, you must configure the access point with a new username and password when it joins the controller. Enter this command using the controller CLI to push a new username and password to the access point:
config ap username user_id password password {Cisco_AP | all}
•
•
The password pushed from the controller is configured as "enable password" on the access point.
There are some cases where the pre-stage configuration for LWAPP access points is disabled and the access point displays the following error message when the CLI commands are applied:
"ERROR!!! Command is disabled."
For more information, refer to Upgrading Autonomous Cisco Aironet Access Points to Lightweight Mode at this URL:
http://www.cisco.com/en/US/docs/wireless/access_point/conversion/lwapp/upgrade/guide/lwapnote.html
Exclusion List (Blacklist) Client Feature
If a client is not able to connect to an access point, and the security policy for the WLAN and client are correct, the client has probably been disabled. In the controller GUI, you can view the client's status on the Monitor > Summary page under Client Summary. If the client is disabled, click Remove to clear the disabled state for that client. The client automatically comes back and, if necessary, reattempts authentication.
Automatic disabling happens as a result of too many failed authentications. Clients disabled due to failed authorization do not appear on the permanent disable display. This display is only for those MACs that are set as permanently disabled by the administrator.
RADIUS Servers and the Management VLAN
If a RADIUS server is on a directly connected subnet (with respect to the controller), then that subnet must be the management VLAN subnet.
Cisco 1000 Series Access Points and WMM
Cisco 1000 series access points in REAP mode do not support the Wi-Fi Multi-Media (WMM) protocol.
Cisco Aironet 1030 Remote Edge Lightweight Access Points and WPA2-PSK
Cisco Aironet 1030 Remote Edge Lightweight Access Points do not support WPA2-PSK in REAP standalone mode.
Lightweight Access Point Connection Limitations
Cisco Aironet lightweight access points do not connect to the 4400 series controller if the date and time are not set properly. Set the current date and time on the controller before allowing the access points to connect to it.
RADIUS Servers
This product has been tested with CiscoSecure ACS 3.2 and later and works with any RFC-compliant RADIUS server.
Management Usernames and Local Netuser Names
Management usernames and local netuser names must be unique because they are stored in the same database. That is, you cannot assign the same name to a management user and a local netuser.
802.1X and Microsoft Wireless Configuration Manager
Clients using the Microsoft Wireless Configuration Manager and 802.1X must use WLANs configured for 40- or 104-bit key length. Configuring for 128-bit key length results in clients that can associate but not authenticate.
Using the Backup Image
The controller bootloader stores a copy of the active primary image and the backup image. If the primary image becomes corrupted, you can use the bootloader to boot with the backup image.
With the backup image stored before rebooting, be sure to choose Option 2: Run Backup Image from the boot menu to boot from the backup image. Then upgrade with a known working image and reboot the controller.
Home Page Retains Web Authentication Login with IE 5.x
Because of a caching problem in the Internet Explorer 5.x browser, the home page retains the web authentication login. To correct this problem, clear the history or upgrade your workstation to Internet Explorer 6.x.
Rogue Location Discovery Protocol (RLDP)
Enabling RLDP may cause access points connected to the controller to lose connectivity with their clients for up to 30 seconds.
Ad-Hoc Rogue Containment
Client card implementations may mitigate the effectiveness of ad-hoc containment.
Changing the Default Values of SNMP Community Strings
The controller has commonly known default values of "public" and "private" for the read-only and read-write SNMP community strings. Using these standard values presents a security risk. Therefore, Cisco strongly advises that you change these values. Refer to the Cisco Wireless LAN Controller Configuration Guide, Release 4.2 for configuration instructions.
Changing the Default Values for SNMP v3 Users
The controller uses a default value of "default" for the username, authentication password, and privacy password for SNMP v3 users. Using these standard values presents a security risk. Therefore, Cisco strongly advises that you change these values. Refer to the Cisco Wireless LAN Controller Configuration Guide, Release 4.2 for configuration instructions.
Note
Features Not Supported on 2000 and 2100 Series Controllers
These hardware features are not supported on 2000 and 2100 series controllers:
•
Note
•
These software features are not supported on 2000 and 2100 series controllers:
•
•
•
•
•
•
Note
•
•
•
•
•
•
•
Some Clients See Only 64 Access Point MAC Addresses (BSSIDs) at a Time
In a crowded RF environment, clients may not be able to detect the desired SSID because of internal table limitations. Sometimes disabling and then enabling the client interface forces a rescan. Your RF environment needs to be controlled. Cisco UWN rogue access point detection and containment can help you to enforce RF policies in your buildings and campuses.
2006 Image Not Supported for 3504 Controllers
The 2006 controller image is supported for use with only 2000 series controllers. Do not install the 2006 image on a 3504 controller. Otherwise, errors may occur. Install only the 3504 image on a 3504 controller.
Running a 3504 Image on a 2000 Series Controller
It is possible to run a 3504 controller image on a 2000 series controller, but Cisco Aironet 1130, 1200, and 1240 series access points will not be able to connect to the controller.
Upgrading External Web Authentication
When upgrading a controller from operating system release 2.0 or 2.2.127.4 to release 3.2.116.21 or later, update the external web authentication configuration as follows:
1.
config custom-web ext-webserver add index IP-address
Note
2.
Note
<html><head><meta http-equiv="Pragma" content="no-cache"> <meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <title>Web Authentication</title> <script>function submitAction(){var link = document.location.href;var searchString = "redirect=";var equalIndex = link.indexOf(searchString);var redirectUrl = "";var urlStr = "";if(equalIndex > 0) {equalIndex += searchString.length;urlStr = link.substring(equalIndex);if(urlStr.length > 0){redirectUrl += urlStr;if(redirectUrl.length > 255)redirectUrl = redirectUrl.substring(0,255);document.forms[0].redirect_url.value = redirectUrl;}}document.forms[0].buttonClicked.value = 4;document.forms[0].submit();}function loadAction(){var url = window.location.href;var args = new Object();var query = location.search.substring(1);var pairs = query.split("&");for(var i=0;i<pairs.length;i++){var pos = pairs[i].indexOf('=');if(pos == -1) continue;var argname = pairs[i].substring(0,pos);var value = pairs[i].substring(pos+1);args[argname] = unescape(value);}//alert( "AP MAC Address is " + args.ap_mac);//alert( "The Switch URL is " + args.switch_url);document.forms[0].action = args.switch_url;// This is the status code returned from webauth login action// Any value of status code from 1 to 5 is error condition and user// should be shown error as below or modify the message as it suits// the customerif(args.statusCode == 1){alert("You are already logged in. No further action is required on your part.");}else if(args.statusCode == 2){alert("You are not configured to authenticate against web portal. No further action is required on your part.");}else if(args.statusCode == 3){alert("The username specified cannot be used at this time. Perhaps the user is already logged into the system?");}else if(args.statusCode == 4){alert("Wrong username and password. Please try again.");}else if(args.statusCode == 5){alert("The User Name and Password combination you have entered is invalid. Please try again.");}}</script></head><body topmargin="50" marginheight="50" onload="loadAction();"> <form method="post"> <input TYPE="hidden" NAME="buttonClicked" SIZE="16" MAXLENGTH="15" value="0"> <input TYPE="hidden" NAME="redirect_url" SIZE="255" MAXLENGTH="255" VALUE=""> <input TYPE="hidden" NAME="err_flag" SIZE="16" MAXLENGTH="15" value="0"><div align="center"><table border="0" cellspacing="0" cellpadding="0"> <tr> <td> </td></tr><tr align="center"> <td colspan="2"><font size="10" color="#336699">Web Authentication</font></td></tr><tr align="center"><td colspan="2"> User Name <input type="TEXT" name="username" SIZE="25" MAXLENGTH="63" VALUE=""> </td> </tr> <tr align="center" > <td colspan="2"> Password <input type="Password" name="password" SIZE="25" MAXLENGTH="24"> </td> </tr><tr align="center"><td colspan="2"><input type="button" name="Submit" value="Submit" class="button" onclick="submitAction();"> </td> </tr> </table> </div></form></body></html>Caveats
The following sections lists Open Caveats and Resolved Caveats in release 4.2.209.0. For your convenience in locating caveats in Cisco's Bug Toolkit, the caveat titles listed in this section are drawn directly from the Bug Toolkit database. These caveat titles are not intended to be read as complete sentences because the title field length is limited. In the caveat titles, some truncation of wording or punctuation might be necessary to provide the most complete and concise description. The only modifications made to these titles are as follows:
•
•
•
Note
http://tools.cisco.com/Support/BugToolKit/
To become a registered cisco.com user, go to the following website:
http://tools.cisco.com/RPF/register/register.do
Open Caveats
These caveats are open in controller software release 4.2.209.0.
Resolved Caveats
These caveats are resolved in controller software release 4.2.209.0.
If You Need More Information
If you need information about a specific caveat that does not appear in these release notes, you can use the Cisco Bug Toolkit to find caveats of any severity. Click this URL to browse to the Bug Toolkit:
http://tools.cisco.com/Support/BugToolKit/
(If you request a defect that cannot be displayed, the defect number might not exist, the defect might not yet have a customer-visible description, or the defect might be marked Cisco Confidential.)
Troubleshooting
For the most up-to-date, detailed troubleshooting information, refer to the Cisco TAC website at
http://www.cisco.com/en/US/support/index.html
Click Product Support > Wireless. Then choose your product and Troubleshooting to find information on the problem you are experiencing.
Documentation Updates
This section lists updates to user documentation that has not yet been added to either printed or online documents.
Omissions
The Package Contents section in the Quick Start Guide: Cisco 4400 Series Wireless LAN Controllers should be updated to include this item, which is included with the 4400 series controller:
•
Related Documentation
For additional information on the Cisco controllers and lightweight access points, refer to these documents:
•
•
•
•
Click this link to browse to the Cisco Support and Documentation page:
http://www.cisco.com/cisco/web/support/index.html
Obtaining Documentation, Support, and Security Guidelines
For information on obtaining documentation, obtaining support, providing documentation feedback, security guidelines, and also recommended aliases and general Cisco documents, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0910R)
© 2010 Cisco Systems, Inc. All rights reserved.
