Cisco

I ran into an interesting problem today. We were retiring our aging B/G radios with brand new dual-band N radios. To fill this need we purchased Cisco Aironet 3502i wireless access points. The Wireless LAN Controller we were using was a Cisco WLC 2106 and could support 6 simultaneous radios. We had confirmed the Wireless LAN Controller was on the latest software release. We attached the first access point and it connected just fine. It discovered, joined and downloaded the updated software from the controller without incident. It showed up in the Cisco management software ready for additional configuration.

We attached the next access point and it got stuck. The status light would alternate green, then red, then off. When we debugged the access point through the console session we could see that it had discovered the correct controller and was sending JOIN commands. However, the handshake would never complete and it would keep cycling the interfaces up and down. It would also give up and occasionally reboot as well, or, show a status that it had reached the maximum number of retries.

We pulled out two more access points – same deal. It seemed so odd because the first one had worked so effortlessly. We knew we weren’t at the maximum radios for the WLC and we knew we didn’t have any problems with territory or county code mismatches. We also checked the WLC clock, certificate, and authentication lists.

The fix was actually quite simple. The 3 WAPs had gone into MESH mode. To remove them from MESH mode was an interesting fix. This is how you do it.

If you have ever been blacklisted for sending spam there is a good chance the source of those emails was not your mail server but a compromised computer inside your network. So, how do you combat this? Well, the easiest way is to create access lists on your firewall to only permit your mail server to send out on port 25 (SMTP). For a Cisco ASA, this can be easily accomplished with 4 lines of code.

While this isn’t exactly groundbreaking stuff I thought it might serve as a nice refresher to those that dabble in the Cisco CLI. These are a few commands you can never do without.