It is almost year 2015 and I was expecting that after 15+ years of wireless 802.11 technology, something like a static “password” for getting secure access to the wireless network is not common anymore. And ofcourse, I was wrong. There are still a lot of devices out there which handle a few (very old) EAP methods or don’t understand dot1X at all. That leaves us with the “pre-shared secret” methods and what if we want to use that at a branch office with a crappy connection to the datacenter / HQ?

Cisco’s FlexConnect with “local authentication” to the rescue! The network traffic is being directly bridged to switchport and when the access-point loses the connection to the WLC, clients will be local authenticated. There is a lot of documentation written about the supported EAP methods and how to configure them, but not for a pre-shared key scenario. So I configured it, tested it and it worked like expected. Curious that I’m, I enabled ssh on the access-point and searched for the pre-shared key in the running configuration. It was not there, so where does the access-point stores this information?

I found out that when I changed the pre-shared key on the WLC a file called “lwapp_non_apspecific_reap.cfg” is being updated on the flash of the access-point. I tried to read it and found out that between a lot of “empty” lines and random chars my SSID and profilenames where in that file in clear text, so my guess is that somewhere in those random chars my “encrypted” pre-shared key is being stored 🙂

Lets say you have a bunch of new access-points who just joined your (v)WLC and you want them to be in flexconnect mode. With the GUI there is no other option than just manually set the mode on a per access-point bases and (pre 8.0) wait for them to reboot. Not any longer! There is a CLI command to do this automatically, so you can get of cup of coffee while this process is getting done…

(Cisco Controller) config>ap autoconvert flexconnect

I love automation… 😀

This time a very short blogpost, but sometimes a photo says more than words… Just to get an idea how all the current access-points types look next to each other.

Left to right:
1. 3702I
2. 2702I
3. 2602I
4. 3502I

Earlier today Cisco released a new software train for the AirOS based wireless lan controllers (WLC’s); the 8.0 train. For me the highlights for this software train are:

• Increased scale to support up to 6000 clients on Cisco Virtual Wireless LAN Controller
• Native IPv6 support
• CleanAir Express on AP1600 (I will dedicate a blogpost on this subject in the near future)
• Change the AP mode from local to flex-connect without a reboot, yay!
• Configuring flashing AP LEDs from the GUI (Can be handy to identify that one access-point without a label or to annoy that person who has complains about the fact the the AP’s are not pretty enough to hang on the ceiling.. 😛 )
• High Density deployment features:
  • Optimized Roaming
  • RSSI Low Check
  • RX-SOP

Oh and I don’t know who requested this particular feature, but you can from now on also use set a red Web Color Theme ..

I have to say that my experience with the now released version (8.0.100) on a 5508 WLC is that the code feels and acts a little buggy; not a release that you want to run in a production environment. My advice is to wait for a maintenance release, but it is always fun to test the new features in the lab 🙂 .

Lets start this post with some theory about wireless and regulations for wireless networks. Here in Europe we have the ETSI who decides which frequencies you are allowed to use for wireless communications and with how much power you may send signals into the air.

For the 2.4Ghz frequencies (802.11b/g/n) this is 20dBm maximum EIRP which is the same as 100mW. For the 5Ghz frequencies (802.11a/n/ac) it depends on the actual channel you are using (for the UNII-1 and UNII-2 frequencies the maximum EIRP 23dBm, for UNII-2 extended this is 30dBm). The EIRP value is calculated as follows: transmitter power (dBm) – cable loss (dB) + amplifier (dB) + antenna gain (dBi).

Lets say you have a Cisco WLC, a Cisco 2602E-E access-point and you are going to use external antennas. How does that work and what do you need to configure so your deployment is legal?

For the Cisco 2602E-E access-point, the WLC calculates default a minimal 2dBi gain for 802.11b and 4dBi gain for 802.11a. This gives for 802.11b the following power levels:
(Cisco Controller) >show ap config 802.11b APb838.61b1.85a3
Tx Power
Num Of Supported Power Levels ............. 5
Tx Power Level 1 .......................... 18 dBm
Tx Power Level 2 .......................... 15 dBm
Tx Power Level 3 .......................... 12 dBm
Tx Power Level 4 .......................... 9 dBm
Tx Power Level 5 .......................... 6 dBm
Tx Power Configuration .................... AUTOMATIC
Current Tx Power Level .................... 1
Tx Power Assigned By ...................... TPC MAX Default

Lets say we are going to use a dual-band directional AIR-ANT2566P4W-R antenna. This antenna has 6dBi gain for both 2.4Ghz and 5Ghz, which is much higher than the default values and would give a too high EIRP value (18 dBm + 6 dBi = 24dBm). In this case we need to tell the WLC what the gain of this antenna is, so that it can lower the access-point power which ensures that the EIRP in no case is going to be too high.

On the GUI you can find this configuration under the tab “Wireless -> Access Points -> Radios -> 802.11a/n/ac / 802.11b/g/n -> click on configure for the correct radio -> Antenna Parameters -> Antenna Gain”. Please look below for a CLI example.

(Cisco Controller) >config 802.11a disable AP01
(Cisco Controller) >config 802.11b disable AP01
(Cisco Controller) >config 802.11a antenna extAntGain 12 AP01
(Cisco Controller) >config 802.11b antenna extAntGain 12 AP01
(Cisco Controller) >config 802.11a enable AP01
(Cisco Controller) >config 802.11b enable AP01

The value you are going to enter needs to be twice the size of the actual antenna gain! If you are running some extra cables between the antenna and the access-point, you can lower the gain value to compensate for that loss.

So now we configured the antenna gain, we can validate the the WLC did actually adjust the power levels:
(Cisco Controller) > show ap config 802.11b AP01
Tx Power
Num Of Supported Power Levels ............. 4
Tx Power Level 1 .......................... 13 dBm
Tx Power Level 2 .......................... 10 dBm
Tx Power Level 3 .......................... 7 dBm
Tx Power Level 4 .......................... 4 dBm
Tx Power Configuration .................... AUTOMATIC
Current Tx Power Level .................... 1
Tx Power Assigned By ...................... TPC MAX Default

The access-point power is (maximum) 13 dBm now + 6 dBi antenna gain gives a EIRP value of 19 dBi 🙂