Table Of Contents
Release Notes for Cisco Wireless LAN Controllers and Lightweight Access Points for Release 6.0.196.0
Cisco Unified Wireless Network Solution Components
Special Rules for Upgrading to Controller Software Release 6.0.196.0
Software Release Support for Access Points
Special Rules for Upgrading to Controller Software 6.0.196.0 in Mesh Networks
Upgrading to a New Software Release
FCC Safety Compliance Statement
Using the Cisco 5500 Series Controller USB Console Port
Important Notes for Controllers and Non-Mesh Access Points
ARP Requests Sometimes Fail for Access Points Connected Directly to
2100 Series ControllersWPlus License Features Included in Base License
Additive Licenses Available for 5500 Series Controllers
One-Time Password (OTP) Support
RADIUS Called-station-id and Calling-station-id Attributes
Using Access Points in Sniffer Mode
Inter-Release Controller Mobility
RLDP Limitations in This Release
802.11g Controller and 802.11b Clients
CAPWAP Problems with Firewalls and ACLs
Messages Appearing Upon Controller Bootup
Cisco 1250 Series Access Points and Cisco 7920 IP Phones
Crash Files for 1250 Series Access Points
Configuration File Stored in XML
Access Points Send Multicast and Management Frames at Highest Basic Rate
40-MHz Channels in the 2.4-GHz Band
802.11a Channels 120, 124, and 128 Disabled
Impact of External Antenna Gain on Transmit Power
Supporting Oversized Access Point Images
MAC Filtering for WGB Wired Clients
CKIP Not Supported with Dynamic WEP
Setting the Date and Time on the Controller
Synchronizing the Controller and Location Appliance
FCC DFS Support on 1130 Series Access Points
Inaccurate Transmit Power Display
Setting the Retransmit Timeout Value for TACACS+ Servers
Configuring an Access Point's Prestandard Power Setting
Controller Functions that Require a Reboot
Rate-Limiting on the Controller
Pings Supported to the Management Interface of the Controller
Pinging from a Network Device to a Controller Dynamic Interface
4400 Series Controllers Do Not Forward Subnet Broadcasts through the Guest Tunnel
Connecting 1100 and 1300 Series Access Points
Preventing Clients from Accessing the Management Network on a Controller
Voice Wireless LAN Configuration
Changing the IOS LWAPP Access Point Password
Exclusion List (Blacklist) Client Feature
RADIUS Servers and the Management VLAN
Management Usernames and Local Netuser Names
Home Page Retains Web Authentication Login with IE 5.x
Changing the Default Values of SNMP Community Strings
Changing the Default Values for SNMP v3 Users
Features Not Supported on 2100 Series Controllers
Features Not Supported on 5500 Series Controllers
Some Clients See Only 64 Access Point MAC Addresses (BSSIDs) at a Time
2106 Image Not Supported for 3504 Controllers
Running a 3504 Image on a 2106 Series Controller
Upgrading External Web Authentication
Important Notes for Controllers and Mesh Access Points
Features Not Supported on Mesh Networks
Obtaining Documentation and Submitting a Service Request
Release Notes for Cisco Wireless LAN Controllers and Lightweight Access Points for Release 6.0.196.0
February 2010
These release notes describe open and resolved caveats for maintenance software release 6.0.196.0 for Cisco 2100, 4400, and 5500 Series Wireless LAN Controllers; Cisco Wireless Services Modules (WiSMs); Cisco Wireless LAN Controller Network Modules; Catalyst 3750G Integrated Wireless LAN Controller Switches; Cisco 3201 Wireless Mobile Interface Cards (WMICs); Cisco Aironet 1100, 1130, 1140, 1200, 1230AG, 1240, 1250, 1300, and AP801 Series Lightweight Access Points; Cisco Aironet 1130AG, 1240AG, 1522, and 1524 Mesh Access Points, which comprise part of the Cisco Unified Wireless Network (UWN) Solution.
Note
Unless otherwise noted, all of the Cisco wireless LAN controllers are referred to as controllers, and all of the Cisco lightweight access points are referred to as access points.
Contents
These release notes contain the following sections.
•
•
•
•
•
•
Cisco Unified Wireless Network Solution Components
The following components are part of the Cisco UWN Solution and are compatible in this release:
•
•
•
•
•
•
•
Note
•
•
•
•
•
•
•
•
•
Note
•
Note
Note
Note
Controller Requirements
The controller GUI requires the following operating system and web browser:
•
•
Note
MIB Files
Cisco controllers support standard SNMP Management Information Base (MIB) files. MIBs can be downloaded from the Software Center on Cisco.com. Only one MIB is posted per major release (6.0, 5.2, 5.1, and so on). If an updated MIB becomes available, the previous version is removed from the Software Center and replaced by the new version.
New Features
This maintenance release does not introduce new features.
Software Release Information
Software is factory installed on your controller and automatically downloaded to the access points after a release upgrade and whenever an access point joins a controller. As new releases become available for the controllers and their access points, consider upgrading.
Note
Note
Note
Note
Note
Finding the Software Release
To find the software release running on your controller, click Monitor and look at the Software Version field under Controller Summary on the controller GUI or enter show sysinfo on the controller CLI.
Special Rules for Upgrading to Controller Software Release 6.0.196.0
Caution
•
•
•
–
–
–
–
•
Note
•
Note
Caution
Software Release Support for Access Points
Table 2 lists the controller software releases that support specific Cisco access points. The First Support column lists the earliest controller software release that supports the access point. For access points that are not supported in ongoing releases, the Last Support column lists the last release that supports the access point.
Table 2 Software Support for Access Points
1000 Series
AIR-AP1010
3.0.100.0
4.2.207.0
AIR-AP1020
3.0.100.0
4.2.207.0
AIR-AP1030
3.0.100.0
4.2.207.0
Airespace AS1200
—
4.1.171.0
1100 Series
AIR-LAP1121
4.0.155.0
—
AIR-LAP1131
3.1.59.24
—
AIR-LAP1141N
5.2.157.0
—
AIR-LAP1142N
5.2.157.0
—
1200 Series
AIR-AP1220A
3.1.59.24
—
AIR-AP1220B
3.1.59.24
—
1230 Series
AIR-AP1230A
3.1.59.24
—
AIR-AP1230B
3.1.59.24
—
AIR-LAP1231G
3.1.59.24
—
AIR-LAP1232AG
3.1.59.24
—
1240 Series
AIR-LAP1242G
3.1.59.24
—
AIR-LAP1242AG
3.1.59.24
—
1250 Series
AIR-LAP1250
4.2.61.0
—
AIR-LAP1252G
4.2.61.0
—
AIR-LAP1252AG
4.2.61.0
—
1300 Series
AIR-BR1310G
4.0.155.0
—
1400 Series
Standalone Only
N/A
—
1500 Mesh Series
AIR-LAP-1505
3.1.59.24
4.2.176.51M
AIR-LAP-1510
3.1.59.24
4.2.176.51M
1520 Mesh Series
AIR-LAP1522AG
-A and N: 4.1.190.1 or 5.2 or later1
—
All other reg. domains: 4.1.191.24M or 5.2 or later1
—
AIR-LAP1522HZ
-A and N: 4.1.190.1 or 5.2 or later1
—
All other reg. domains: 4.1.191.24M or 5.2 or later1
—
AIR-LAP1522PC
-A and N: 4.1.190.1 or 5.2 or later1
—
All other reg. domains: 4.1.191.24M or 5.2 or later1
—
AIR-LAP1524SB
-A, C and N: 6.0 or later
—
AIR-LAP1524PS
-A: 4.1.192.22M or 5.2 or later1
—
1 These access points are supported in the separate 4.1.19x.x Mesh Software Release train or with Release 5.2 or later. These access points are not supported in the 4.2, 5.0, or 5.1 Release trains.
Special Rules for Upgrading to Controller Software 6.0.196.0 in Mesh Networks
Caution
Upgrade Compatibility Matrix
Table 3 outlines the upgrade compatibility of controller mesh and non-mesh releases and indicates the intermediate software releases required as part of the upgrade path.
Software Upgrade Notes
•
Note
•
•
•
•
•
Table 3 Upgrade Compatibility Matrix for Controller Mesh and Non-Mesh Releases
6.0.196.0
6.0.182.0
5.2
4.1.192.35M
4.1.191.24M
4.1.190.5
4.1.185.0
4.1.171.0
4.0.219.0
4.0.217.204
4.0.217.0
4.0.216.0
4.0.206.0
4.0.179.11
4.0.179.8
4.0.155.5
4.0.155.0
3.2.195.10
3.2.193.5
3.2.171.6
3.2.171.5
3.2.150.10
3.2.150.6
3.2.116.21
3.2.78.0
3.1.111.0
3.1.105.0
4.1.192.35M
Y
Y
4.1.192.22M
Y
Y
Y
4.1.191.24M
Y
-
4.1.190.5
Y1
Y
-
4.1.185.0
Y
Y2
-
4.1.181.0
Y2
Y2
4.1.171.0
Y2
Y2
-
4.0.219.0
Y2
Y2
-
4.0.217.204
Y2
Y2
Y2
Y2
-
4.0.217.0
Y2
Y2
Y2
Y3
-
4.0.216.0
Y2
Y2
Y2
Y3
Y
-
4.0.206.0
Y2
Y2
Y2
Y3
Y
-
4.0.179.11
Y
Y4
-
4.0.179.8
Y
Y4
Y
-
4.0.155.5
Y
Y4
Y
Y
-
4.0.155.0
Y
Y4
Y
Y
Y
-
3.2.195.10
Y
Y4
Y
Y
Y
-
3.2.193.5
Y
Y4
Y
Y
Y
Y
-
3.2.171.6
Y
Y4
Y
Y
Y
Y
-
3.2.171.5
Y
Y4
Y
Y
Y
Y
Y
-
3.2.150.10
Y
Y4
Y
Y
Y
Y
Y
-
3.2.150.6
Y
Y4
Y
Y
Y
Y
Y
Y
-
3.2.116.21
Y
Y4
Y
Y
Y
Y
Y
Y
-
3.2.78.0
Y
Y4
Y
Y
Y
Y
Y
Y
Y
-
3.1.111.0
Y
Y
Y
Y
Y
-
3.1.105.0
Y
Y
Y
Y
Y
Y
-
3.1.59.24
Y
Y
Y
Y
Y
Y
Y
1 You can upgrade directly from software release 4.1.190.5 to 4.1.192.35M; however, upgrading to 4.1.191.24M before upgrading to 4.1.192.35M is highly recommended.
2 CUSTOMERS WHO REQUIRE DYNAMIC FREQUENCY SELECTION (DFS) FUNCTIONALITY SHOULD NOT USE THIS RELEASE. This release does not provide DFS functionality fixes found in release 4.0.217.204. Additionally, this release is not supported in ETSI-compliant countries or Singapore.
3 Release 4.0.217.204 provides fixes for DFS on 1510 series access points. This functionality is needed only in countries where DFS rules apply.
4 An upgrade to 4.0.206.0 is not allowed in the following country codes when operating with the following access points: Australia (1505 and 1510), Brazil (1505 and 1510), Hong Kong (1505 and 1510), India (1505 and 1510), Japan (1510), Korea (1505 and 1510), Mexico (1505 and 1510), New Zealand (1505 and 1510), and Russia (1505 and 1510). Note: The 1505 mesh access point is not supported in release 5.0 and later. The 1510 mesh access point is supported only in mesh releases 4.1.190.5, 4.1.191.22M, and 4.1.192.xxM.
Upgrading to a New Software Release
When you upgrade the controller's software, the software on the controller's associated access points is also automatically upgraded. When an access point is loading software, each of its LEDs blinks in succession. Up to 10 access points can be concurrently upgraded from the controller.
Note
Caution
Note
Note
Note
Follow these steps to upgrade the controller software using the controller GUI.
Step 1
Note
Step 2
a.
http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=278875243
b.
c.
d.
e.
f.
g.
h.
i.
•
•
•
j.
k.
l.
m.
n.
o.
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Step 9
Step 10
Step 11
Step 12
Step 13
a.
b.
c.
Step 14
Step 15
Step 16
Step 17
Step 18
Step 19
Step 20
Step 21
Step 22
Step 23
Step 24
Note
Installation Notes
This section contains important information to keep in mind when installing controllers and access points.
Warnings
Warning
Warning
Warning
Warning
Warning
Warning
Warning
Warning
Warning
Warning
Safety Information
Follow the guidelines in this section to ensure proper operation and safe use of the controllers and access points.
FCC Safety Compliance Statement
FCC Compliance with its action in ET Docket 96-8, has adopted a safety standard for human exposure to RF electromagnetic energy emitted by FCC-certified equipment. When used with approved Cisco Aironet antennas, Cisco Aironet products meet the uncontrolled environmental limits found in OET-65 and ANSI C95.1, 1991. Proper operation of this radio device according to the instructions in this publication results in user exposure substantially below the FCC recommended limits.
Safety Precautions
For your safety, and to help you achieve a good installation, read and follow these safety precautions. They may save your life!
1.
2.
3.
4.
5.
a.
b.
c.
6.
7.
8.
Installation Instructions
Refer to the appropriate quick start guide or hardware installation guide for instructions on installing controllers and access points.
Note
Personnel installing the controllers and access points must understand wireless techniques and grounding methods. Access points with internal antennas can be installed by an experienced IT professional.
The controller must be installed by a network administrator or qualified IT professional, and the proper country code must be selected. Following installation, access to the controller should be password protected by the installer to maintain compliance with regulatory requirements and ensure proper unit functionality.
Using the Cisco 5500 Series Controller USB Console Port
The USB console port on the 5500 series controllers connects directly to the USB connector of a PC using a USB Type A-to-5-pin mini Type B cable.
Note
For operation with Microsoft Windows, the Cisco Windows USB console driver must be installed on any PC connected to the console port. With this driver, you can plug and unplug the USB cable into and from the console port without affecting Windows HyperTerminal operations.
Note
USB Console OS Compatibility
•
•
•
To install the Cisco Windows USB console driver, follow these steps:
Step 1
a.
http://tools.cisco.com/support/downloads/go/Redirect.x?mdfid=278875243
b.
c.
d.
e.
f.
g.
Step 2
Step 3
Step 4
Note
http://support.microsoft.com/kb/918365The USB driver is mapped to COM port 6. Some terminal emulation programs do not recognize a port higher than COM 4. If necessary, change the Cisco USB systems management console COM port to an unused port of COM 4 or lower. To do so, follow these steps:
Step 1
Step 2
Step 3
Step 4
Step 5
Step 6
Step 7
Step 8
Important Notes for Controllers and Non-Mesh Access Points
This section describes important information about controllers and non-mesh lightweight access points.
ARP Requests Sometimes Fail for Access Points Connected Directly to
2100 Series ControllersCisco 2100 series controllers do not support ARP requests from access points connected directly to a port on the controller unless there is an interface configured on that controller port. ARP requests from the access point cannot reach the gateway on the interface VLAN and the access point might lose its connection to the controller.
To work around this limitation, configure the access point's default gateway to match the controller's management IP address, or connect the access point to a switch port between the access point and the 2100 series controller.
WPlus License Features Included in Base License
All features included in a Wireless LAN Controller WPlus license are now included in the base license; this change is introduced in release 6.0.196.0. There are no changes to WCS BASE and PLUS licensing.
These WPlus license features are included in the base license:
•
•
•
The licensing change can affect features on your wireless LAN when you upgrade or downgrade software releases, so you should be aware of these guidelines:
•
•
•
Note
Additive Licenses Available for 5500 Series Controllers
You can now purchase licenses to support additional access points on 5500 series controllers. The new additive licenses (for 25, 50, or 100 access points) can be upgraded from all license tiers (12, 25, 50, 100, and 250 access points). The additive licenses are supported through both rehosting and RMAs.
One-Time Password (OTP) Support
One Time Passwords (OTP) are supported on the Wireless Lan Controller (WLC) using TACACS and RADIUS. In this configuration, the controller acts as a transparent pass-thru device. The controller forwards all client requests to the TACACS/RADIUS server without inspecting the client behavior. When using OTP the client must only establish a single connection to the controller to function properly. The controller currently does not have any intelligence or checks to correct a client that is trying to establish multiple connections.
RADIUS Called-station-id and Calling-station-id Attributes
In software releases prior to 6.0, the controller sends uppercase alpha characters in the MAC address. In software release 6.0 or later, the controller sends lowercase alpha characters in the MAC address for the RADIUS called-station-id and calling-station-id attributes. If you enabled these attributes for 802.1X authentication in previous releases and upgrade to software release 6.0, client authentication fails. Therefore, you must change the MAC addresses to lowercase characters on the RADIUS server before upgrading to software release 6.0.
Access Point Groups
You can create up to 50 access point groups for 2100 series controllers and controller network modules and up to 192 access point groups for 4400 series controllers, 5500 series controllers, the Cisco WiSM, and the 3750G wireless LAN controller switch.
Using Access Points in Sniffer Mode
You must disable IP-MAC address binding in order to use an access point in sniffer mode if the access point is joined to a 5500 series controller, a 2100 series controller, or a controller network module running software release 6.0. To disable IP-MAC address binding, enter this command using the controller CLI: config network ip-mac-binding disable.
WLAN 1 must be enabled in order to use an access point in sniffer mode if the access point is joined to a 5500 series controller, a 2100 series controller, or a controller network module running software release 6.0. If WLAN 1 is disabled, the access point cannot send packets.
Inter-Release Controller Mobility
When controllers in the mobility list are running different software releases (such as 5.0, 5.1, 5.2, and 6.0), Layer 2 or Layer 3 client roaming is not supported between GD to ED. It is supported only between controllers running the same and GD release such as 6.0 and 4.2.
Guest tunneling works only between controllers running the same software release or between controllers running software release 4.2 and controllers running any later software release (for example, 4.2 to 5.0, 4.2 to 5.1, 4.2 to 5.2, or 4.2 to 6.0). Guest tunneling does not work among controllers running other combinations of software.
RLDP Limitations in This Release
Rogue Location Discovery Protocol (RLDP) is a controller feature that detects the presence of rogue access points that are connected to your wired network. In this software release, RLDP operates with these limitations:
•
•
•
•
•
Also, in controller software release 6.0, the rogue containment packet transmission times have changed as follows:
•
•
Internal DHCP Server
When clients use the controller's internal DHCP server, IP addresses are not preserved across reboots. As a result, multiple clients can be assigned the same IP address. To resolve any IP address conflicts, clients must release their existing IP address and request a new one.
Bootloader Menu
When you plug a controller into an AC power source, the bootup script and power-on self-test run to initialize the system. During this time, you can press Esc to display the bootloader Boot Options Menu. The menu options for the 5500 series controllers are different than for other controller platforms.
Bootloader Menu for 5500 Series Controllers
Boot OptionsPlease choose an option from below:1. Run primary image2. Run backup image3. Change active boot image4. Clear Configuration5. Format FLASH Drive6. Manually update imagesPlease enter your choice:Bootloader Menu for Other Controller Platforms
Boot OptionsPlease choose an option from below:1. Run primary image2. Run backup image3. Manually update images4. Change active boot image5. Clear ConfigurationPlease enter your choice:
Enter 1 to run the current software, enter 2 to run the previous software, or enter 4 (on a 5500 series controller) or 5 (on another controller platform) to run the current software and set the controller configuration to factory defaults. Do not choose the other options unless directed to do so.
Note
Note
Fragmented Pings
Cisco 5500 series controllers do not support fragmented pings on any interface. Similarly, Cisco 4400 series controllers, the Cisco WiSM, and the Catalyst 3750G Integrated Wireless LAN Controller Switch do not support fragmented pings on the AP-manager interface.
802.11g Controller and 802.11b Clients
When a controller is configured to allow only 802.11g traffic, 802.11b client devices are able to successfully associate to an access point but cannot pass traffic. When you configure the controller for 802.11g traffic only, disable any channels (such as channel 14 in Japan) that allow associations from 802.11b client devices.
FIPS 140-2
The Cisco 4400 series controllers, the Cisco WiSM, and the Catalyst 3750G Wireless LAN Controller Switch have received NIST FIPS 140-2 Level 2 certification. Click this link to view the NIST Security Policies and compliant software versions:
http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/1401vend.htm
CAPWAP Problems with Firewalls and ACLs
If you have a firewall or access control list (ACL) between the controller and its access points that allows LWAPP traffic, before upgrading to software release 5.2 or later and CAPWAP, you should allow CAPWAP traffic from the access points to the controller by opening the following destination ports:
•
•
The access points use a random UDP source port to reach these destination ports on the controller. In controller software release 5.2, LWAPP was removed and replaced by CAPWAP, but if you have a new out-of-the-box access point, it could try to use LWAPP to contact the controller before downloading the CAPWAP image from the controller. Once the access point downloads the CAPWAP image from the controller, it uses only CAPWAP to communicate with the controller.
Note
Note
Messages Appearing Upon Controller Bootup
Several messages might flood the message logs when the controller boots up. These messages appear because of a failure to read or delete several different configuration files. These are low-severity messages that can safely be ignored. They do not affect controller functionality. These are some examples:
Mar 18 16:05:56.753 osapi_file.c:274 OSAPI-5-FILE_DEL_FAILED: Failed to delete the file : sshpmInitParms.cfg. file removal failed.-Process: Name:fp_main_task, Id:11ca7618Mar 18 16:05:56.753 osapi_file.c:274 OSAPI-5-FILE_DEL_FAILED: Failed to delete the file : bcastInitParms.cfg. file removal failed.-Process: Name:fp_main_task, Id:11ca7618Web Authentication Redirects
The controller supports web authentication redirects only to HTTP (HTTP over TCP) servers. It does not support web authentication redirects to HTTPS (HTTP over SSL) servers.
Note
Cisco 1250 Series Access Points and Cisco 7920 IP Phones
Cisco 1250 series access points are not supported for use with the Cisco 7920 IP phone. They can, however, be used with the Cisco 7921 and 7925 IP phones.
Crash Files for 1250 Series Access Points
The 1250 series access points may contain a bootloader older than version 12.4(10b)JA. Units with old bootloaders do not generate a crash log when a crash occurs. The crash log is disabled so that a crash does not corrupt the flash file system. Units with bootloader versions 12.4(10b)JA or later generate a crash log if the access point is associated to a controller running software release 4.2.112.0 or later.
New 1250 series access points shipped from the factory contain new bootloader images, which fixes the flash file system after it is corrupted during a crash (without losing files). This new bootloader automatically sets a new CRASH_LOG environment variable to "yes," which enables a crash log to be generated following a crash but only on controllers running software release 4.2.112.0 or later. Therefore, no user configuration is needed to enable a crash log on new 1250 series access points shipped from the factory.
These examples show the output from the CLI commands (in bold) that you use to check the bootloader version on lightweight and autonomous 1250 series access points:
Commands entered on the controller CLI:
debug ap enable AP001b.d513.1754
debug ap command "show version | include BOOTLDR" AP001b.d513.1754
Thu Apr 23 09:31:38 2009: AP001b.d513.1754: BOOTLDR: C1250 Boot Loader(C1250-BOOT-M) Version 12.4(10b)JA, RELEASE SOFTWARE (fc1)Command entered on the access point CLI:
show version | include BOOTLDR
BOOTLDR: C1250 Boot Loader (C1250-BOOT-M) Version 12.4(10b)JA, RELEASE SOFTWARE (fc1)Configuration File Stored in XML
In controller software release 4.2.61.0 and later, the controller's bootup configuration file is stored in an Extensible Markup Language (XML) format rather than in binary format. When you upgrade a controller to 4.2.61.0 or a later software release, the binary configuration file is migrated and converted to XML.
Note
Note
LWAPP Mode Changes
When you upgrade to controller software release 5.0.148.0 or later, the LWAPP mode changes to Layer 3 if it was previously configured for Layer 2.
If you downgrade from controller software release 6.0.196.0, 6.0.188.0, 5.2.178.0, 5.2.157.0, 5.1.151.0, or 5.0.148.0 to 4.2.61.0 or an earlier release, the LWAPP mode changes from Layer 3 to Layer 2. Access points might not join the controller, and you must manually reset the controller to Layer 3 to resolve this issue.
Access Points Send Multicast and Management Frames at Highest Basic Rate
Access points running recent Cisco IOS versions transmit multicast frames at the highest configured basic rate and management frames at lowest basic mandatory rates. This can cause reliability problems. Access points running LWAPP or autonomous Cisco IOS should transmit multicast and management frames at the lowest configured basic rate. Such behavior is necessary to provide good coverage at the cell's edge, especially for unacknowledged multicast transmissions where multicast wireless transmissions may fail to be received.
Because multicast frames are not retransmitted at the MAC layer, clients at the edge of the cell may fail to receive them successfully. If reliable reception is a goal, then multicast frames should be transmitted at a low data rate. If support for high data rate multicast frames is required, then it may be useful to shrink the cell size and disable all lower data rates.
Depending on your specific requirements, you can take the following action:
•
•
Disabling Radio Bands
The controller disables the radio bands that are not permitted by the configured country of operation (CSCsi48220).
40-MHz Channels in the 2.4-GHz Band
Cisco recommends that you do not configure 40-MHz channels in the 2.4-GHz radio band because severe co-channel interference is likely to occur.
802.11a Channels 120, 124, and 128 Disabled
802.11a channels 120, 124, and 128 are disabled to achieve compliance with draft EN 301 893 version 1.5.1 on the following -E regulatory domain products: AP1131AG, AP1243AG, and AP1252AG.
Impact of External Antenna Gain on Transmit Power
In controller software release 4.2 or later, external antenna gain is factored into the maximum transmit power of the access point. Therefore, when you upgrade from an earlier software release to 4.2 or later, you might see a decrease in transmit power output.
Supporting Oversized Access Point Images
Controller software release 4.2 or later allows you to upgrade to an oversized access point image by deleting the recovery image to create sufficient space. This feature affects only access points with 8 MB of flash (the 1100, 1200, and 1310 series access points). All newer access points have a larger flash size than 8 MB.
Note
The recovery image provides a backup image that can be used if an access point power-cycles during an image upgrade. The best way to avoid the need for access point recovery is to prevent an access point from power-cycling during a system upgrade. If a power-cycle occurs during an upgrade to an oversized access point image, you can recover the access point using the TFTP recovery procedure.
Follow these steps to recover the access point using the TFTP recovery procedure.
Step 1
Step 2
Step 3
Multicast Queue Depth
The multicast queue depth is 512 packets on all controller platforms. However, the following message might appear on 2106 controllers: "Rx Multicast Queue is full on Controller." This message does not appear on 4400 series controllers because the 4400 NPU filters ARP packets while all forwarding (multicast or otherwise) and multicast replication are done in the software on the 2106.
This message appears when too many multicast messages are sent to the CPU. In controller software releases prior to 5.1, multicast, CDP, and ARP packets share the same queue. However, in software releases 5.1 and later, these packets are separated into different queues. There are currently no controller commands that can be entered to determine if the multicast receive queue is full. When the queue is full, some packets are randomly discarded.
MAC Filtering for WGB Wired Clients
Controller software release 4.1.178.0 or later enables you to configure a MAC-filtering IP address for a workgroup bridge (WGB) wired client to allow passive WGB wired clients, such as terminal servers or printers with static IP addresses, to be added and remain in the controller's client table while the WGB is associated to a controller in the mobility group. This feature, activated by the config macfilter ipaddress MAC_address IP_address CLI command, can be used with any passive device that does not initiate any traffic but waits for another device to start communication.
This feature allows the controller to learn the IP address of a passive WGB wired client when the WGB sends an IAPP message to the controller that contains only the WGB wired client's MAC address. Upon receiving this message from the WGB, the controller checks the local MAC filter list (or the anchor controller's MAC filter list if the WGB has roamed) for the client's MAC address. If an entry is found and it contains an IP address for the client, the controller adds the client to the controller's client table.
Note
Note
CKIP Not Supported with Dynamic WEP
In controller software release 4.1.185.0 or later, CKIP is supported for use only with static WEP. It is not supported for use with dynamic WEP. Therefore, a wireless client that is configured to use CKIP with dynamic WEP is unable to associate to a wireless LAN that is configured for CKIP. Cisco recommends that you use either dynamic WEP without CKIP (which is less secure) or WPA/WPA2 with TKIP or AES (which are more secure).
Setting the Date and Time on the Controller
Cisco Aironet lightweight access points do not connect to the controller if the date and time are not set properly. Set the current date and time on the controller before allowing the access points to connect to it.
Synchronizing the Controller and Location Appliance
For controller software release 4.2 or later, if a location appliance (release 3.1 or later) is installed on your network, the time zone must be set on the controller to ensure proper synchronization between the two systems. Also, Cisco highly recommends that the time be set for networks that do not have location appliances. Refer to Chapter 4 of the Cisco Wireless LAN Controller Configuration Guide, Release 5.2 for instructions for setting the time and date on the controller.
Note
FCC DFS Support on 1130 Series Access Points
Federal Communications Commission (FCC) dynamic frequency selection (DFS) is supported only on 1130 series access points in the United States, Canada, and the Philippines that have a new FCC ID. Access points use DFS to detect radar signals such as military and weather sources and then switch channels to avoid interfering with them. 1130 series access points with FCC DFS support have an FCC ID LDK102054E sticker. 1130 series access points without FCC DFS support have an LDK102054 (no E suffix) sticker. 1130 series access points that are operating in the United States, Canada, or the Philippines; have an FCC ID E sticker; and are running the 4.1.171.0 software release or later can use channels 100 through 140 in the UNII-2 band.
Inaccurate Transmit Power Display
After you change the position of the 802.11a radio antenna for a lightweight 1200 or 1230 series access point, the power setting is not updated in the controller GUI and CLI. Regardless of the user display, the internal data is updated, and the transmit power output is changed accordingly. To see the correct transmit power display values, reboot the access point after changing the antenna's position. (CSCsf02280)
Setting the Retransmit Timeout Value for TACACS+ Servers
Cisco recommends that the retransmit timeout value for TACACS+ authentication, authorization, and accounting servers be increased if you experience repeated reauthentication attempts or the controller falls back to the backup server when the primary server is active and reachable. The default retransmit timeout value is 2 seconds and can be increased to a maximum of 30 seconds.
Configuring an Access Point's Prestandard Power Setting
An access point can be powered by a Cisco prestandard 15-watt switch with Power over Ethernet (PoE) by entering this command:
config ap power pre-standard {enable | disable} {all | Cisco_AP}
A Cisco prestandard 15-watt switch does not support intelligent power management (IPM) but does have sufficient power for a standard access point. The following Cisco prestandard 15-watt switches are available:
•
•
•
•
•
•
•
•
•
The enable version of this command is required for full functionality when the access point is powered by a Cisco prestandard 15-watt switch. It is safe to use if the access point is powered by either an IPM switch or a power injector or if the access point is not using one of the 15-watt switches listed above.
You might need this command if your radio operational status is "Down" when you expect it to be "Up." Enter the show msglog command to look for this error message, which indicates a PoE problem:
Apr 13 09:08:24.986 spam_lrad.c:2262 LWAPP-3-MSGTAG041: AP 00:14:f1:af:f3:40 is unable to verify sufficient in-line power. Radio slot 0 disabled.Controller Functions that Require a Reboot
After you perform these functions on the controller, you must reboot the controller in order for them to take effect:
•
•
•
•
2106 Controller LEDs
The 2106 controller's Status LED and AP LED do not flash amber when software is being uploaded to the controller or downloaded to an access point, respectively.
Note
Rate-Limiting on the Controller
Rate-limiting is applicable to all traffic destined to the CPU from either direction (wireless or wired). Cisco recommends that you always run the controller with the default config advanced rate enable command in effect in order to rate-limit traffic to the controller and protect against denial-of-service (DoS) attacks. You can use the config advanced rate disable command to stop rate-limiting of Internet Control Message Protocol (ICMP) echo responses for testing purposes. However, Cisco recommends that you reapply the config advanced rate enable command after testing is complete.
Pings Supported to the Management Interface of the Controller
Controller software release 4.1.185.0 or later is designed to support ICMP pings to the management interface either from a wireless client or a wired host. ICMP pings to other interfaces configured on the controller are not supported.
Pinging from a Network Device to a Controller Dynamic Interface
Pinging from a network device to a controller dynamic interface may not work in some configurations. When pinging does operate successfully, the controller places Internet Control Message Protocol (ICMP) traffic in a low-priority queue, and the reply to ping is on best effort. Pinging does not pose a security threat to the network. The controller rate limits any traffic to the CPU, and flooding the controller is prevented. Clients on the WLAN associated with the interface pass traffic normally.
GLBP Not Supported
Controller software release 4.2 or later is not compatible with the Gateway Load Balancing Protocol (GLBP). Make sure to configure the controller's default gateway to a fixed address and not to the GLBP virtual address.
4400 Series Controllers Do Not Forward Subnet Broadcasts through the Guest Tunnel
As designed, 4400 series controllers do not forward IP subnet broadcasts from the wired network to wireless clients across the EoIP guest tunnel.
Connecting 1100 and 1300 Series Access Points
You must install software release 4.0.179.8 or later on the controller before connecting 1100 and 1300 series access points to the controller.
Preventing Clients from Accessing the Management Network on a Controller
To prevent or block a wired or wireless client from accessing the management network on a controller (from the wireless client dynamic interface or VLAN), the network administrator should ensure that there is no route through which to reach the controller from the dynamic interface or use a firewall between the client dynamic interface and the management network.
Voice Wireless LAN Configuration
Cisco recommends that aggressive load balancing always be turned off either through the controller GUI or CLI in any wireless network that is supporting voice, regardless of vendor. When aggressive load balancing is turned on, voice clients can hear an audible artifact when roaming, and the handset is refused at its first reassociation attempt.
Changing the IOS LWAPP Access Point Password
Cisco IOS Lightweight Access Point Protocol (LWAPP) access points have a default password of Cisco, and the pre-stage configuration for LWAPP access points is disabled by default. To enable it, you must configure the access point with a new username and password when it joins the controller. Enter this command using the controller CLI to push a new username and password to the access point:
config ap mgmtuser add user_id password password {Cisco_AP | all}
•
•
The password pushed from the controller is configured as "enable password" on the access point.
There are some cases where the pre-stage configuration for LWAPP access points is disabled and the access point displays the following error message when the CLI commands are applied:
"ERROR!!! Command is disabled."
For more information, refer to Upgrading Autonomous Cisco Aironet Access Points to Lightweight Mode.
Exclusion List (Blacklist) Client Feature
If a client is not able to connect to an access point, and the security policy for the WLAN and client are correct, the client has probably been disabled. In the controller GUI, you can view the client's status on the Monitor > Summary page under Client Summary. If the client is disabled, click Remove to clear the disabled state for that client. The client automatically comes back and, if necessary, reattempts authentication.
Automatic disabling happens as a result of too many failed authentications. Clients disabled due to failed authorization do not appear on the permanent disable display. This display is only for those MACs that are set as permanently disabled by the administrator.
RADIUS Servers and the Management VLAN
If a RADIUS server is on a directly connected subnet (with respect to the controller), then that subnet must be the management VLAN subnet.
RADIUS Servers
This product has been tested with CiscoSecure ACS 4.2 and later and works with any RFC-compliant RADIUS server.
Management Usernames and Local Netuser Names
Management usernames and local netuser names must be unique because they are stored in the same database. That is, you cannot assign the same name to a management user and a local netuser.
Using the Backup Image
The controller bootloader stores a copy of the active primary image and the backup image. If the primary image becomes corrupted, you can use the bootloader to boot with the backup image.
With the backup image stored before rebooting, be sure to choose Option 2: Run Backup Image from the boot menu to boot from the backup image. Then upgrade with a known working image and reboot the controller.
Home Page Retains Web Authentication Login with IE 5.x
Because of a caching problem in the Internet Explorer 5.x browser, the home page retains the web authentication login. To correct this problem, clear the history or upgrade your workstation to Internet Explorer 6.x.
Ad-Hoc Rogue Containment
Client card implementations may mitigate the effectiveness of ad-hoc containment.
Changing the Default Values of SNMP Community Strings
The controller has commonly known default values of "public" and "private" for the read-only and read-write SNMP community strings. Using these standard values presents a security risk. Therefore, Cisco strongly advises that you change these values. Refer to the Cisco Wireless LAN Controller Configuration Guide, Release 5.2 for configuration instructions.
Changing the Default Values for SNMP v3 Users
The controller uses a default value of "default" for the username, authentication password, and privacy password for SNMP v3 users. Using these standard values presents a security risk. Therefore, Cisco strongly advises that you change these values. Refer to the Cisco Wireless LAN Controller Configuration Guide, Release 5.2 for configuration instructions.
Note
Features Not Supported on 2100 Series Controllers
This hardware feature is not supported on 2100 series controllers:
•
These software features are not supported on 2100 series controllers:
•
•
Note
•
•
•
•
•
•
•
•
•
Features Not Supported on 5500 Series Controllers
These software features are not supported on 5500 series controllers:
•
Note
•
•
•
•
•
•
Note
•
Note
Some Clients See Only 64 Access Point MAC Addresses (BSSIDs) at a Time
In a crowded RF environment, clients may not be able to detect the desired SSID because of internal table limitations. Sometimes disabling and then enabling the client interface forces a rescan. Your RF environment needs to be controlled. Cisco UWN rogue access point detection and containment can help you to enforce RF policies in your buildings and campuses.
2106 Image Not Supported for 3504 Controllers
The 2106 controller image is supported for use with only 2100 series controllers. Do not install the 2106 image on a 3504 controller. Otherwise, errors may occur. Install only the 3504 image on a 3504 controller.
Running a 3504 Image on a 2106 Series Controller
It is possible to run a 3504 controller image on a 2106 series controller, but Cisco Aironet 1130, 1200, and 1240 series access points will not be able to connect to the controller.
Upgrading External Web Authentication
When upgrading a controller from operating system release 2.0 or 2.2.127.4 to release 3.2.116.21 or later, update the external web authentication configuration as follows:
1.
2.
config custom-web ext-webserver add index IP-address
Note
3.
Note
<html><head><meta http-equiv="Pragma" content="no-cache"> <meta HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <title>Web Authentication</title> <script>function submitAction(){var link = document.location.href;var searchString = "redirect=";var equalIndex = link.indexOf(searchString);var redirectUrl = "";var urlStr = "";if(equalIndex > 0) {equalIndex += searchString.length;urlStr = link.substring(equalIndex);if(urlStr.length > 0){redirectUrl += urlStr;if(redirectUrl.length > 255)redirectUrl = redirectUrl.substring(0,255);document.forms[0].redirect_url.value = redirectUrl;}}document.forms[0].buttonClicked.value = 4;document.forms[0].submit();}function loadAction(){var url = window.location.href;var args = new Object();var query = location.search.substring(1);var pairs = query.split("&");for(var i=0;i<pairs.length;i++){var pos = pairs[i].indexOf('=');if(pos == -1) continue;var argname = pairs[i].substring(0,pos);var value = pairs[i].substring(pos+1);args[argname] = unescape(value);}//alert( "AP MAC Address is " + args.ap_mac);//alert( "The Switch URL is " + args.switch_url);document.forms[0].action = args.switch_url;// This is the status code returned from webauth login action// Any value of status code from 1 to 5 is error condition and user// should be shown error as below or modify the message as it suits// the customerif(args.statusCode == 1){alert("You are already logged in. No further action is required on your part.");}else if(args.statusCode == 2){alert("You are not configured to authenticate against web portal. No further action is required on your part.");}else if(args.statusCode == 3){alert("The username specified cannot be used at this time. Perhaps the user is already logged into the system?");}else if(args.statusCode == 4){alert("Wrong username and password. Please try again.");}else if(args.statusCode == 5){alert("The User Name and Password combination you have entered is invalid. Please try again.");}}</script></head><body topmargin="50" marginheight="50" onload="loadAction();"> <form method="post"> <input TYPE="hidden" NAME="buttonClicked" SIZE="16" MAXLENGTH="15" value="0"> <input TYPE="hidden" NAME="redirect_url" SIZE="255" MAXLENGTH="255" VALUE=""> <input TYPE="hidden" NAME="err_flag" SIZE="16" MAXLENGTH="15" value="0"><div align="center"><table border="0" cellspacing="0" cellpadding="0"> <tr> <td> </td></tr><tr align="center"> <td colspan="2"><font size="10" color="#336699">Web Authentication</font></td></tr><tr align="center"><td colspan="2"> User Name <input type="TEXT" name="username" SIZE="25" MAXLENGTH="63" VALUE=""> </td> </tr> <tr align="center" > <td colspan="2"> Password <input type="Password" name="password" SIZE="25" MAXLENGTH="24"> </td> </tr><tr align="center"><td colspan="2"><input type="button" name="Submit" value="Submit" class="button" onclick="submitAction();"> </td> </tr> </table> </div></form></body></html>Important Notes for Controllers and Mesh Access Points
This section describes important information about controllers and mesh access points.
Features Not Supported on Mesh Networks
The following controller features are not supported on mesh networks:
•
•
•
•
•
•
•
Caveats
The following sections lists Open Caveats and Resolved Caveats for Cisco controllers and lightweight access points for version 6.0.196.0. For your convenience in locating caveats in Cisco's Bug Toolkit, the caveat titles listed in this section are drawn directly from the Bug Toolkit database. These caveat titles are not intended to be read as complete sentences because the title field length is limited. In the caveat titles, some truncation of wording or punctuation might be necessary to provide the most complete and concise description. The only modifications made to these titles are as follows:
•
•
•
Note
http://www.cisco.com/support/bugtools.
To become a registered cisco.com user, go to the following website:
http://tools.cisco.com/RPF/register/register.do
Open Caveats
Table 4 lists open caveats in controller software release 6.0.196.0.
Resolved Caveats
Table 5 lists caveats resolved in controller software release 6.0.196.0.
If You Need More Information
If you need information about a specific caveat that does not appear in these release notes, you can use the Cisco Bug Toolkit to find caveats of any severity. Click this URL to browse to the Bug Toolkit:
http://www.cisco.com/pcgi-bin/Support/Bugtool/launch_bugtool.pl
(If you request a defect that cannot be displayed, the defect number might not exist, the defect might not yet have a customer-visible description, or the defect might be marked Cisco Confidential.)
Troubleshooting
For the most up-to-date, detailed troubleshooting information, refer to the Cisco TAC website at
http://www.cisco.com/en/US/support/index.html
Click Product Support > Wireless. Then choose your product and Troubleshooting to find information on the problem you are experiencing.
Documentation Updates
This section lists updates to user documentation that has not yet been added to either printed or online documents.
Omissions
The Package Contents section in the Quick Start Guide: Cisco 4400 Series Wireless LAN Controllers should be updated to include this item, which is included with the 4400 series controller:
•
Related Documentation
For additional information on the Cisco controllers and lightweight access points, refer to these documents:
•
•
•
•
You can access these documents from this link:
http://www.cisco.com/cisco/web/psa/default.html
Obtaining Documentation and Submitting a Service Request
For information on obtaining documentation, submitting a service request, and gathering additional information, see the monthly What's New in Cisco Product Documentation, which also lists all new and revised Cisco technical documentation, at:
http://www.cisco.com/en/US/docs/general/whatsnew/whatsnew.html
Subscribe to the What's New in Cisco Product Documentation as a Really Simple Syndication (RSS) feed and set content to be delivered directly to your desktop using a reader application. The RSS feeds are a free service and Cisco currently supports RSS Version 2.0.
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Nurse Connect, Cisco Pulse, Cisco SensorBase, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, Flip Gift Card, and One Million Acts of Green are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Lumin, Cisco Nexus, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Follow Me Browsing, GainMaker, iLYNX, IOS, iPhone, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, SenderBase, SMARTnet, Spectrum Expert, StackWise, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0910R)
Guest