How to Configure Cisco 3850 Switches?

In this converged access product platform, you should have some familiarity with the new Cisco 3850 switch, especially the answer for “how to configure a Cisco 3850 switch for basic wireless connectivity?” Now, let’s share the 5 key points of using 3850 as WLC firstly.

1. Attach your access points directly to your 3850 switches (every wiring closet you should have this in order to all building AP to be connect to this new environment)

2. Wireless management vlan & AP management vlan should be identical. (If you configure vlan 20 as wireless management in 3850 switch all your APs connected to this switch should be on access vlan 20.)

3. Enable Mobility Controller (MC) functionality to terminate CAP/WAP (or register AP). By default, when you enable wireless management, switch will act as Mobility Agent (MA) & not able to terminate CAP/WAP.

4. “ipbase” or “ipservices” feature set to be there for CAP/WAP termination.”lanbase” cannot be used.

5. Given 3850 switch stack can support maximum 50 APs.

Catalyst 3850 switch (the picture is from Cisco.com)

In the following example, we will have two 3850 switches stacked together. (We will have latest software code- IOS-XE 3.2.3SE on this switch. Then let’s get down to business:

New image to flash of Cisco 3850 switch:

3850-1#copy tftp://192.168.20.51/firmware/cat3k_caa-universalk9.SPA.03.02.03.SE.150-1.EX3.bin flash:

Destination filename [cat3k_caa-universalk9.SPA.03.02.03.SE.150-1.EX3.bin]?

Accessing tftp://192.168.20.51/firmware/cat3k_caa-universalk9.SPA.03.02.03.SE.150-1.EX3.bin...

Loading firmware/cat3k_caa-universalk9.SPA.03.02.03.SE.150-1.EX3.bin from 192.168.20.51 (via Vlan999):

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

!!!!!!!!!!!!!!

[OK - 223743040 bytes]

 There are two modes called "INSTALL" & "BUNDLE" available in these new switches. If you want to boot in "INSTALL" mode you have to copy the image onto flash first. In "BUNDLE" mode, you can keep the image on TFTP & boot if required. But in BUNDLE mode switch require more memory to do this function, meanwhile, the preferred method is doing it via "INSTALL" mode.

You can use "software install file <file_location>“command to install new software onto your switch. At the end it will prompt to reload the switch as shown below:

3850-1#software install file flash:cat3k_caa-universalk9.SPA.03.02.03.SE.150-1.EX3.bin

Preparing install operation...

[1]: Copying software from active switch 1 to switch 2

[1]: Finished copying software to switch 2

[1 2]: Starting install operation

[1 2]: Expanding bundle flash:cat3k_caa-universalk9.SPA.03.02.03.SE.150-1.EX3.bin

[1 2]: Copying package files

[1 2]: Package files copied

[1 2]: Finished expanding bundle flash:cat3k_caa-universalk9.SPA.03.02.03.SE.150-1.EX3.bin

[1 2]: Verifying and copying expanded package files to flash:

[1 2]: Verified and copied expanded package files to flash:

[1 2]: Starting compatibility checks

[1 2]: Finished compatibility checks

[1 2]: Starting application pre-installation processing

[1 2]: Finished application pre-installation processing

[1]: Old files list:

 Removed cat3k_caa-base.SPA.03.02.02.SE.pkg

 Removed cat3k_caa-drivers.SPA.03.02.02.SE.pkg

 Removed cat3k_caa-infra.SPA.03.02.02.SE.pkg

 Removed cat3k_caa-iosd-universalk9.SPA.150-1.EX2.pkg

 Removed cat3k_caa-platform.SPA.03.02.02.SE.pkg

 Removed cat3k_caa-wcm.SPA.10.0.111.0.pkg

[2]: Old files list:

 Removed cat3k_caa-base.SPA.03.02.02.SE.pkg

 Removed cat3k_caa-drivers.SPA.03.02.02.SE.pkg

 Removed cat3k_caa-infra.SPA.03.02.02.SE.pkg

 Removed cat3k_caa-iosd-universalk9.SPA.150-1.EX2.pkg

 Removed cat3k_caa-platform.SPA.03.02.02.SE.pkg

 Removed cat3k_caa-wcm.SPA.10.0.111.0.pkg

[1]: New files list:

 Added cat3k_caa-base.SPA.03.02.03.SE.pkg

 Added cat3k_caa-drivers.SPA.03.02.03.SE.pkg

 Added cat3k_caa-infra.SPA.03.02.03.SE.pkg

 Added cat3k_caa-iosd-universalk9.SPA.150-1.EX3.pkg

 Added cat3k_caa-platform.SPA.03.02.03.SE.pkg

 Added cat3k_caa-wcm.SPA.10.0.120.0.pkg

[2]: New files list:

 Added cat3k_caa-base.SPA.03.02.03.SE.pkg

 Added cat3k_caa-drivers.SPA.03.02.03.SE.pkg

 Added cat3k_caa-infra.SPA.03.02.03.SE.pkg

 Added cat3k_caa-iosd-universalk9.SPA.150-1.EX3.pkg

 Added cat3k_caa-platform.SPA.03.02.03.SE.pkg

 Added cat3k_caa-wcm.SPA.10.0.120.0.pkg

[1 2]: Creating pending provisioning file

[1 2]: Finished installing software. New software will load on reboot.

[1 2]: Committing provisioning file

[1 2]: Do you want to proceed with reload? [yes/no]: yes

[2]: Reloading

[1]: Pausing before reload

Now look at your flash directory, there could be multiple versions of the .conf files & .pkg files depending on the number of images came with your switch and the frequency you upgraded the switch. You can clean this directory using “software clean” command which will result deleting all unwanted file from your directory. In this way you will only keep 3.2.3SE related files on your flash.

3850-1#dir

Directory of flash:/

85193 -rw- 2097152 Sep 28 2013 14:28:26 +10:00 nvram_config

85187 -rw- 74410468 Jan 1 1970 11:01:11 +11:00 cat3k_caa-base.SPA.03.02.00SE.pkg

85188 -rw- 2773680 Jan 1 1970 11:01:12 +11:00 cat3k_caa-drivers.SPA.03.02.00.SE.pkg

85189 -rw- 32478044 Jan 1 1970 11:01:12 +11:00 cat3k_caa-infra.SPA.03.02.00SE.pkg

85190 -rw- 30393116 Jan 1 1970 11:01:12 +11:00 cat3k_caa-iosd-universalk9.SPA.150-1.EX.pkg

85191 -rw- 18313952 Jan 1 1970 11:01:12 +11:00 cat3k_caa-platform.SPA.03.02.00.SE.pkg

85192 -rw- 63402700 Jan 1 1970 11:01:12 +11:00 cat3k_caa-wcm.SPA.10.0.100.0.pkg

85199 -rw- 1224 Sep 28 2013 14:19:19 +10:00 packages.conf

85196 -rw- 8916 Sep 26 2013 15:59:58 +10:00 vlan.dat

85195 -rw- 114 Jun 6 2013 08:31:45 +10:00 express_setup.debug

85194 -rw- 1224 Sep 25 2013 02:20:20 +10:00 packages.conf.00-

 7750 -rw- 74369252 Sep 25 2013 02:20:16 +10:00 cat3k_caa-base.SPA.03.02.02.SE.pkg

 7751 -rw- 5808828 Sep 25 2013 02:20:16 +10:00 cat3k_caa-drivers.SPA.03.02.02.SE.pkg

 7752 -rw- 32488292 Sep 25 2013 02:20:16 +10:00 cat3k_caa-infra.SPA.03.02.02.SE.pkg

 7753 -rw- 30403764 Sep 25 2013 02:20:16 +10:00 cat3k_caa-iosd-universalk9.SPA.150-1.EX2.pkg

 7754 -rw- 16079584 Sep 25 2013 02:20:16 +10:00 cat3k_caa-platform.SPA.03.02.02.SE.pkg

 7755 -rw- 64580300 Sep 25 2013 02:20:17 +10:00 cat3k_caa-wcm.SPA.10.0.111.0.pkg

85186 -rw- 223743040 Sep 28 2013 13:30:24 +10:00 cat3k_caa-universalk9.SPA.03.02.03.SE.150-1.EX3.bin

85198 -rw- 1218 Jan 1 1970 11:01:22 +11:00 packages.conf.01-

30979 -rw- 74369716 Sep 28 2013 14:19:15 +10:00 cat3k_caa-base.SPA.03.02.03.SE.pkg

30980 -rw- 5808828 Sep 28 2013 14:19:15 +10:00 cat3k_caa-drivers.SPA.03.02.03.SE.pkg

30981 -rw- 32496484 Sep 28 2013 14:19:15 +10:00 cat3k_caa-infra.SPA.03.02.03.SE.pkg

30982 -rw- 30418104 Sep 28 2013 14:19:15 +10:00 cat3k_caa-iosd-universalk9.SPA.150-1.EX3.pkg

30983 -rw- 16059104 Sep 28 2013 14:19:15 +10:00 cat3k_caa-platform.SPA.03.02.03.SE.pkg

30984 -rw- 64586444 Sep 28 2013 14:19:15 +10:00 cat3k_caa-wcm.SPA.10.0.120.0.pkg

1621966848 bytes total (723390464 bytes free)

3850-1#software clean

Preparing clean operation...

[1 2]: Cleaning up unnecessary package files

[1 2]: No path specified, will use booted path flash:packages.conf

[1 2]: Cleaning flash:

[1]: Preparing packages list to delete ...

 cat3k_caa-base.SPA.03.02.03.SE.pkg

 File is in use, will not delete.

 cat3k_caa-drivers.SPA.03.02.03.SE.pkg

 File is in use, will not delete.

 cat3k_caa-infra.SPA.03.02.03.SE.pkg

 File is in use, will not delete.

 cat3k_caa-iosd-universalk9.SPA.150-1.EX3.pkg

 File is in use, will not delete.

 cat3k_caa-platform.SPA.03.02.03.SE.pkg

 File is in use, will not delete.

 cat3k_caa-wcm.SPA.10.0.120.0.pkg

 File is in use, will not delete.

 packages.conf

 File is in use, will not delete.

[2]: Preparing packages list to delete ...

 cat3k_caa-base.SPA.03.02.03.SE.pkg

 File is in use, will not delete.

 cat3k_caa-drivers.SPA.03.02.03.SE.pkg

 File is in use, will not delete.

 cat3k_caa-infra.SPA.03.02.03.SE.pkg

 File is in use, will not delete.

 cat3k_caa-iosd-universalk9.SPA.150-1.EX3.pkg

 File is in use, will not delete.

 cat3k_caa-platform.SPA.03.02.03.SE.pkg

 File is in use, will not delete.

 cat3k_caa-wcm.SPA.10.0.120.0.pkg

 File is in use, will not delete.

 packages.conf

 File is in use, will not delete.

[1]: Files that will be deleted:

 cat3k_caa-base.SPA.03.02.00SE.pkg

 cat3k_caa-base.SPA.03.02.02.SE.pkg

 cat3k_caa-drivers.SPA.03.02.00.SE.pkg

 cat3k_caa-drivers.SPA.03.02.02.SE.pkg

 cat3k_caa-infra.SPA.03.02.00SE.pkg

 cat3k_caa-infra.SPA.03.02.02.SE.pkg

 cat3k_caa-iosd-universalk9.SPA.150-1.EX.pkg

 cat3k_caa-iosd-universalk9.SPA.150-1.EX2.pkg

 cat3k_caa-platform.SPA.03.02.00.SE.pkg

 cat3k_caa-platform.SPA.03.02.02.SE.pkg

 cat3k_caa-universalk9.SPA.03.02.03.SE.150-1.EX3.bin

 cat3k_caa-wcm.SPA.10.0.100.0.pkg

 cat3k_caa-wcm.SPA.10.0.111.0.pkg

 packages.conf.00-

 packages.conf.01-

[2]: Files that will be deleted:

 cat3k_caa-base.SPA.03.02.00SE.pkg

 cat3k_caa-base.SPA.03.02.02.SE.pkg

 cat3k_caa-drivers.SPA.03.02.00.SE.pkg

 cat3k_caa-drivers.SPA.03.02.02.SE.pkg

 cat3k_caa-infra.SPA.03.02.00SE.pkg

 cat3k_caa-infra.SPA.03.02.02.SE.pkg

 cat3k_caa-iosd-universalk9.SPA.150-1.EX.pkg

 cat3k_caa-iosd-universalk9.SPA.150-1.EX2.pkg

 cat3k_caa-platform.SPA.03.02.00.SE.pkg

 cat3k_caa-platform.SPA.03.02.02.SE.pkg

 cat3k_caa-universalk9.SPA.03.02.03.SE.150-1.EX3.bin

 cat3k_caa-wcm.SPA.10.0.100.0.pkg

 cat3k_caa-wcm.SPA.10.0.111.0.pkg

 packages.conf.00-

 packages.conf.01-

[1 2]: Do you want to proceed with the deletion? [yes/no]: yes

[1 2]: Clean up completed

3850-1#dir

Directory of flash:/

85193 -rw- 2097152 Sep 28 2013 14:28:26 +10:00 nvram_config

85199 -rw- 1224 Sep 28 2013 14:19:19 +10:00 packages.conf

85196 -rw- 8916 Sep 26 2013 15:59:58 +10:00 vlan.dat

85195 -rw- 114 Jun 6 2013 08:31:45 +10:00 express_setup.debug

30979 -rw- 74369716 Sep 28 2013 14:19:15 +10:00 cat3k_caa-base.SPA.03.02.03.SE.pkg

30980 -rw- 5808828 Sep 28 2013 14:19:15 +10:00 cat3k_caa-drivers.SPA.03.02.03.SE.pkg

30981 -rw- 32496484 Sep 28 2013 14:19:15 +10:00 cat3k_caa-infra.SPA.03.02.03.SE.pkg

30982 -rw- 30418104 Sep 28 2013 14:19:15 +10:00 cat3k_caa-iosd-universalk9.SPA.150-1.EX3.pkg

30983 -rw- 16059104 Sep 28 2013 14:19:15 +10:00 cat3k_caa-platform.SPA.03.02.03.SE.pkg

30984 -rw- 64586444 Sep 28 2013 14:19:15 +10:00 cat3k_caa-wcm.SPA.10.0.120.0.pkg

1621966848 bytes total (1393401856 bytes free)

In this step, you can verify switch is having upgraded image in each member of the switch stack.

3850-1#sh ver | be SW

Switch Ports Model              SW Version        SW Image              Mode  

------ ----- -----              ----------        ----------            ----  

     1 56    WS-C3850-48P       03.02.03.SE       cat3k_caa-universalk9 INSTALL

     2 56    WS-C3850-48P       03.02.03.SE       cat3k_caa-universalk9 INSTALL

You can verify boot configuration of your switch using "show boot" CLI command. As you can see "packages.conf" file is the boot loading file used in the booting process. If this file not exists or corrupted, the switch will go onto ROMMON mode."

3850-1#sh boot

---------------------------

Switch 1

---------------------------

Current Boot Variables:

BOOT variable = flash:packages.conf;

Boot Variables on next reload:

BOOT variable = flash:packages.conf;

Manual Boot = no

Enable Break = no

You can access wireless controller GUI using https://<switch-ipaddress>/wireless URL.

Cisco 3850 switch configuration example

It is different when compare to CUWN controllers (5508,2504, etc). Let's see how we can configure the wireless controller config on this switch. First of all you need to ensure you have the correct license to start with.

3850-1#show license right-to-use?

 default Displays the default license information.

 detail Displays details of all the licenses in the stack.

 eula Displays the EULA text.

 mismatch Displays mismatch license information.

 slot Specify switch number

 summary Displays consolidated stack wide license information.

 usage Displays the usage details of all licenses.

 | Output modifiers

 <cr>

3850-1#show license right-to-use summary

License Name Type Count Period left

-----------------------------------------------

 lanbase permanent N/A Lifetime

 apcount base 0 Lifetime

 apcount adder 0 Lifetime

 --------------------------------------------

 License Level In Use: ipbase

 License Level on Reboot: ipbase

 Evaluation AP-Count: Disabled

 Total AP Count Licenses: 0

 AP Count Licenses In-use: 0

 AP Count Licenses Remaining: 0

In Converged Access architecture, 3850 can act as Mobility Agent (MA) or Mobility Controller (MC). By default it is a MA. Normally AP license should be on a MC where CAP/WAP tunnels from AP get terminated. In this case we have only 3850 switch for everything (MC & MA) so you have to install AP license onto this switch. Remember that maximum 50 APs can be supported by a 3850 switch stack. In our case we will configure 25 licenses each for the first two members of stack & all APs to be terminated in these two switches (max 25 in each member).

3850-1#license right-to-use?

 activate activate particular license level

 deactivate deactivate particular license level

3850-1#license right-to-use activate?

 apcount configure the AP-count licenses on the switch

 ipbase activate ipbase license on the switch

 ipservices activate Ipservices license on the switch

 lanbase activate lanbase license on the switch

3850-1#license right-to-use activate apcount?

 <1-50> configure the number of adder licenses

 evaluation activate evaluation license

3850-1#license right-to-use activate apcount 50?

 slot Specify switch number

3850-1#license right-to-use activate apcount 50 slot?

 <1-9> Specify switch number

3850-1#license right-to-use activate apcount 50 slot 1?

 acceptEULA automatically accept the EULA for the given license

 <cr>

3850-1#license right-to-use activate apcount 50 slot 1 acceptEULA

3850-1#license right-to-use activate apcount 50 slot 2 acceptEULA

% switch-2:stack-mgr:ACTIVATION FAIL : Total AP Count Licenses exceed maximum limit

!

3850-1#license right-to-use deactivate apcount 25 slot 1

3850-1#license right-to-use activate apcount 25 slot 2 acceptEULA

You have to enable the MC functionality of 3850 by using the "wireless mobility controller" CLI command as shown below.

3850-1(config)#wireless mobility ?

 controller Configures mobility controller settings

 dscp Configures the Mobility inter controller DSCP value

 group Configures the Mobility group parameters

 load-balance Configure mobility load-balance status

 multicast Configures the Multicast Mode for mobility messages

 oracle Configures mobility oracle settings

3850-1(config)#wireless mobility controller ?

 ip no description

 peer-group Configures mobility peer groups

 <cr>

3850-1(config)#wireless mobility controller

Now we are one step away to register our AP. To register AP you should nominate an interface as wireless management interface. You have to remember that all your AP should be configured with same vlan access port where you configured for wireless management, otherwise AP won’t join. In our case we will use vlan21 as wireless management interface & configure switch port connected to AP in vlan 21.

interface Vlan21

 ip address 192.168.21.1 255.255.255.0

!

wireless management interface Vlan21

!

interface GigabitEthernet1/0/1

switchport access vlan 21

switchport mode access

spanning-tree portfast

Now if you type "show ap summary" you would see your AP get registered to your 3850 WLC.

3850-1#show ap summary

Number of APs: 1

Global AP User Name: Not configured

Global AP Dot1x User Name: Not configured

AP Name                           AP Model  Ethernet MAC    Radio MAC       State        

----------------------------------------------------------------------------------------

bc16.6516.790e                    3602I     bc16.6516.790e  f41f.c298.c2a0  Registered

You can change any AP specific configuration by using "ap name <AP-NAME> x" CLI commands. Following are the all options available. we will change the name as example.

5508-1#ap name bc16.6516.790e?

  ap-groupname      Set groupname

  bhrate            Bridge Backhaul Tx Rate

  bridgegroupname   Set bridgegroupname

  bridging          Enable Ethernet-to-Ethernet bridging

  capwap            AP Capwap parameters

  command           Remote execute a command on Cisco AP

  console-redirect  Enable redirecting remote debug output of Cisco AP to

                    console

  core-dump         Enable memory core dump on Cisco AP

  country           Configure the country of operation

  crash-file        Manage crash data and radio core files for Cisco AP

  dot11             Configures 802.11 parameters

  dot1x-user        Enable the 802.1X credential for the current AP

  ethernet          Configure Ethernet Port of the AP

  image             Configure image

  led               Enable LED-state for Cisco AP

  link-encryption   Enable link encryption state on Cisco AP

  link-latency      Enable Link Latency on Cisco AP

  location          Configure AP location

  mfp               Enable Management Frame Protection

  mgmtuser          Configures user name, password and secret for AP management

  mode              Select AP mode of operation

  monitor-mode      Monitor-mode channel optimization

  name              Configure AP name

  no                Negate a command or set its defaults

  power             Configure Cisco Power over Ethernet (PoE) feature for AP

  reset             Reset AP

  reset-button      Disable or enable reset button on AP

  shutdown          Disable AP

  slot              Set slot number

  sniff             Enable sniffing on dot11a/b radio

  ssh               Enable SSH

  static-ip         Set Cisco AP static IP address configuration

  stats-timer       Set the frequency at which statistics are sent from AP

  syslog            Set the system logging settings for Cisco AP

  tcp-adjust-mss    TCP MSS configuration for an AP

  telnet            Enable telnet for Cisco AP

  tftp-downgrade    Initiate AP image downgrade from a TFTP server

5508-1#ap name bc16.6516.790e name L3600-1

5508-1#show ap summary

Number of APs: 1

Global AP User Name: Not configured

Global AP Dot1x User Name: Not configured

AP Name                           AP Model  Ethernet MAC    Radio MAC       State        

----------------------------------------------------------------------------------------

L3600-1                           3602I     bc16.6516.790e  f41f.c298.c2a0  Registered

You can use "show ap name <AP_NAME> x" CLI commands to view specific AP configurations.

name L3600-1 ?                   

  auto-rf          Auto-RF information for a Cisco AP

  bhmode           Show Cisco Bridge Backhaul Mode

  bhrate           Show Cisco Bridge Backhaul Rate

  cac              Display Call Admission Control details

  capwap           AP Capwap parameters

  ccx              Shows ccx related information

  cdp              Shows Cisco AP cdp information

  channel          Shows the channel information of an Cisco AP

  config           Shows the configuration of an Cisco AP

  core-dump        Shows the AP memory core dump setting for an Cisco AP

  data-plane       Show data plane status

  dot11            Show 802.11 parameters

  ethernet         Shows ethernet information

  eventlog         Downloads and displays the event log of a Cisco AP

  image            Shows the images present on a Cisco AP

  inventory        Displays the inventory of a Cisco AP

  link-encryption  Show link encryption status

  service-policy   Show service policy information

  tcp-adjust-mss   Show tcp-adjust-mss  for an AP

  wlan             Show BSSIDs for each AP

5508-1#show ap name L3600-1 config general

Cisco AP Name                                   : L3600-1

Cisco AP Identifier                             : 3

Country Code                                    : AU  - Australia

Regulatory Domain Allowed by Country            : 802.11bg:-A     802.11a:-N

AP Country Code                                 : AU  - Australia

AP Regulatory Domain                            : Unconfigured

Switch Port Number                              : Gi1/0/1

MAC Address                                     : bc16.6516.790e

IP Address Configuration                        : DHCP

IP Address                                      : 192.168.21.53

IP Netmask                                      : 255.255.255.0

Gateway IP Address                              : 192.168.21.254

CAPWAP Path MTU                                 : 1500

Telnet State                                    : Disabled

SSH State                                       : Disabled

Cisco AP Location                               : default location

Cisco AP Group Name                             : default-group

Administrative State                            : Enabled

Operation State                                 : Registered

AP Mode                                         : Local

AP Submode                                      : Not Configured

Remote AP Debug                                 : Disabled

Logging Trap Severity Level                     : informational

Software Version                                : 10.0.101.0

Boot Version                                    : 15.2.2.4

Stats Reporting Period                          : 180

LED State                                       : Enabled

PoE Pre-Standard Switch                         : Disabled

PoE Power Injector MAC Address                  : Disabled

Power Type/Mode                                 : Power Injector/Normal Mode

Number of Slots                                 : 2

AP Model                                        : 3602I

AP Image                                        : C3600-K9W8-M

IOS Version                                     : 15.2(2)JN$

Reset Button                                    : Enabled

AP Serial Number                                : FGL1721X3K5

AP Certificate Type                             : Manufacture Installed

Management Frame Protection Validation          : Disabled

AP User Mode                                    : Automatic

AP User Name                                    : Not Configured

AP 802.1X User Mode                             : Not Configured

AP 802.1X User Name                             : Not Configured

Cisco AP System Logging Host                    : 255.255.255.255

AP Up Time                                      : 3 days 20 hours 14 minutes 26 seconds

AP CAPWAP Up Time                               : 3 days 20 hours 12 minutes 57 seconds

Join Date and Time                              : 09/24/2013 19:01:11

If you want to configure global settings for all APs then you have to go for the configuration mode & then use "ap x " CLI command as shown below. We will change Country code as example. You can add upto 20 country codes if you have AP in multiple countries.

3850-1#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

3850-1(config)#ap ?

  auth-list         Configure Access Point authorization list

  bridging          Enable/Disable Ethernet-to-Ethernet bridging on all Cisco APs

  capwap            ap capwap parameters

  cdp               Enable/Disable CDP for all Cisco APs

  core-dump         Enable/Disable memory core dump on all Cisco APs

  country           Configure the country of operation

  dot11             Configures 802.11 parameters

  dot1x             Configure the 802.1X credential for all APs

  ethernet          Configure Ethernet Port on all Cisco APs

  group             Manage AP Groups VLAN feature

  led               Enable/Disable LED-state for all Cisco APs

  link-encryption   Enable link encryption state on all Cisco AP's

  link-latency      Enable Link Latency on all Cisco AP's

  mgmtuser          Configure the user for AP management

  power             Configure Cisco Power over Ethernet (PoE) feature for all AP's

  reporting-period  Configure AP rogue/error reporting period

  reset-button      Enable/Disable reset button for all Cisco APs

  static-ip         Set Cisco AP static IP address configuration

  syslog            Configure the system logging settings for Cisco AP

  tcp-adjust-mss    Enable/Disable TCP MSS configuration for all Cisco APs

  tftp-downgrade    Initiate AP image downgrade from a TFTP server for all Cisco APs

3850-1(config)#ap country ?

  WORD  Enter the country code (e.g. US,MX,IN) upto a maximum of 20 countries

3850-1(config)#ap country AU

Changing country code could reset channel and RRM grouping configuration. If running in RRM One-Time mode, reassign channels after this command. Check customized APs for valid channel values after this command.

Are you sure you want to continue? (y/n)[y]: y

3850-1(config)#

Next we will configure a WLAN.

5508-1(config)#wlan ?

  WORD      Enter Profile Name up to 32 alphanumeric characters

  shutdown  Enable/disable all WLANs

5508-1(config)#wlan MRN-CCIEW ?

  <1-64>  Create WLAN Identifier

  <cr>

5508-1(config)#wlan MRN-CCIEW 1 ?

  WORD  Enter SSID (Network Name) up to 32 alphanumeric characters

  <cr>

5508-1(config)#wlan MRN-CCIEW 1 MRN-CCIEW

5508-1(config-wlan)#no shutdown

You can verify WLAN configuration in your “show running-config all” output.

5508-1#show running-config all | section wlan

wlan MRN-CCIEW 1 MRN-CCIEW

 accounting-list

 channel-scan defer-time 100

 client association limit 0

 client vlan default

 dtim dot11 24ghz 1

 dtim dot11 5ghz 1

 exclusionlist timeout 60

 ip access-group web none

 ip access-group none

 ip dhcp server 0.0.0.0

 ipv6 traffic-filter web none

 ipv6 traffic-filter none

 mac-filtering

 radio all

 security dot1x authentication-list

 security dot1x encryption 104

 security static-wep-key authentication open

 security tkip hold-down 60

 security web-auth authentication-list

 security web-auth parameter-map

 service-policy client input unknown

 service-policy client output unknown

 service-policy input unknown

 service-policy output unknown

 session-timeout 1800

 no shutdown

You can configure any WLAN specific configs as shown below. You have to shutdown the WLAN before make any changes.

5508-1(config)#wlan MRN-CCIEW 1 MRN-CCIEW

5508-1(config-wlan)#?

  aaa-override         AAA policy override

  accounting-list      Set the accounting list for IEEE 802.1x

  band-select          Allow|Disallow Band Select on a WLAN.

  broadcast-ssid       Set broadcast SSID on a WLAN

  call-snoop           Call Snooping support

  ccx                  Configure Cisco Client Extension options

  channel-scan         Configures off channel scanning deferral parameters

  chd                  Set CHD per WLAN

  client               WLAN configuration for clients

  datalink             WLAN Datalink commands

  default              Set a command to its defaults

  diag-channel         Set Diagnostics Channel Capability on a WLAN

  dtim                 Set the DTIM period for the WLAN

  exclusionlist        Set exclusion-listing on WLAN

  exit                 Exit sub-mode

  ip                   WLAN IP configuration commands

  ipv6                 IPv6 WLAN subcommands

  load-balance         Allow|Disallow Load Balance on a WLAN.

  local-auth           Set the EAP Profile on a WLAN

  mac-filtering        Set MAC filtering support on WLAN

  media-stream         Configures media stream

  mfp                  Configures Management Frame Protection

  mobility             Configure mobility

  nac                  Configures Radius NAC support(Identity Service Engine).

  no                   Negate a command or set its defaults

  passive-client       Configures passive client feature

  peer-blocking        Configure peer-to-peer blocking on a WLAN

  radio                Configures the Radio Policy

  roamed-voice-client  Configure Roaming Attrbutes for Voice Clients

  security             Configures the security policy for a WLAN

  service-policy       Configure WLAN QOS Service Policy

  session-timeout      Configures client timeout

  shutdown             Disable WLAN

  sip-cac              Configure Wlan Sip-Cac attributes

  static-ip            Configures static IP client tunneling support on a WLAN.

  uapsd                Configure WMM UAPSD attributes for Wlan

  wgb                  Configures WGB support on the WLAN

  wmm                  Configures WMM (WME)

5508-1(config-wlan)#client vlan 51

% switch-1:wcm:Request failed - WLAN in the enabled state.

5508-1(config-wlan)#shut

5508-1(config-wlan)#client vlan 51

5508-1(config-wlan)#radio ?

  all      Enable all available radios

  dot11a   Enable 802.11a radio only

  dot11ag  Enable 802.11 a and g radios

  dot11bg  Enable 802.11b and g radios

  dot11g   Enable 802.11g radio only

5508-1(config-wlan)#radio dot11a

5508-1(config-wlan)#wmm ?

  allowed  Allows WMM on the WLAN

  require  Requires WMM enabled clients on the WLAN

5508-1(config-wlan)#wmm require

5508-1(config-wlan)#ip ?

  access-group  Specify WLAN ACL

  dhcp          Configure DHCP parameters for WLAN

  flow          Flexible Netflow commands

  multicast     Configure multicast

  verify        verify

5508-1(config-wlan)#ip dhcp ?

  opt82     Set DHCP option 82 for wireless clients on this WLAN

  required  Specify whether DHCP address assignment is required

  server    Configures the WLAN's IPv4 DHCP Server

5508-1(config-wlan)#ip dhcp server 192.168.51.1

5508-1(config-wlan)#no shut

You can verify WLAN settings “show wlan id <WLAN_ID>” CLI command as shown below.

5508-1#show wlan id 1

WLAN Profile Name     : MRN-CCIEW

================================================

Identifier                                     : 1

Network Name (SSID)                            : MRN-CCIEW

Status                                         : Enabled

Broadcast SSID                                 : Enabled

Maximum number of Associated Clients           : 0

AAA Policy Override                            : Disabled

Network Admission Control

  NAC-State                                    : Disabled

Number of Active Clients                       : 0

Exclusionlist Timeout                          : 60

Session Timeout                                : 1800 seconds

CHD per WLAN                                   : Enabled

Webauth DHCP exclusion                         : Disabled

Interface                                      : 51

Interface Status                               : Unconfigured

Multicast Interface                            : Unconfigured

WLAN IPv4 ACL                                  : unconfigured

WLAN IPv6 ACL                                  : unconfigured

DHCP Server                                    : 192.168.51.1

DHCP Address Assignment Required               : Disabled

DHCP Option 82                                 : Disabled

DHCP Option 82 Format                          : ap-mac

DHCP Option 82 Ascii Mode                      : Disabled

DHCP Option 82 Rid Mode                        : Disabled

QoS Service Policy - Input

  Policy Name                                  : unknown

  Policy State                                 : None

QoS Service Policy - Output

  Policy Name                                  : unknown

  Policy State                                 : None

QoS Client Service Policy

  Input  Policy Name                           : unknown

  Output Policy Name                           : unknown

WMM                                            : Required

Channel Scan Defer Priority:

  Priority (default)                           : 4

  Priority (default)                           : 5

  Priority (default)                           : 6

Scan Defer Time (msecs)                        : 100

Media Stream Multicast-direct                  : Disabled

CCX - AironetIe Support                        : Enabled

CCX - Gratuitous ProbeResponse (GPR)           : Disabled

CCX - Diagnostics Channel Capability           : Disabled

Dot11-Phone Mode (7920)                        : Invalid

Wired Protocol                                 : None

Peer-to-Peer Blocking Action                   : Disabled

Radio Policy                                   : 802.11a only

DTIM period for 802.11a radio                  : 1

DTIM period for 802.11b radio                  : 1

Local EAP Authentication                       : Disabled

Mac Filter Authorization list name             : Disabled

Accounting list name                           : Disabled

802.1x authentication list name                : Disabled

Security

    802.11 Authentication                      : Open System

    Static WEP Keys                            : Disabled

    802.1X                                     : Disabled

    Wi-Fi Protected Access (WPA/WPA2)          : Enabled

        WPA (SSN IE)                           : Disabled

        WPA2 (RSN IE)                          : Enabled

            TKIP Cipher                        : Disabled

            AES Cipher                         : Enabled

        Auth Key Management

            802.1x                             : Enabled

            PSK                                : Disabled

            CCKM                               : Disabled

    CKIP                                       : Disabled

    IP Security                                : Disabled

    IP Security Passthru                       : Disabled

    L2TP                                       : Disabled

    Web Based Authentication                   : Disabled

    Conditional Web Redirect                   : Disabled

    Splash-Page Web Redirect                   : Disabled

    Auto Anchor                                : Disabled

    Sticky Anchoring                           : Enabled

    Cranite Passthru                           : Disabled

    Fortress Passthru                          : Disabled

    PPTP                                       : Disabled

    Infrastructure MFP protection              : Enabled

    Client MFP                                 : Optional

    Webauth On-mac-filter Failure              : Disabled

    Webauth Authentication List Name           : Disabled

    Webauth Parameter Map                      : Disabled

    Tkip MIC Countermeasure Hold-down Timer    : 60

Call Snooping                                  : Disabled

Passive Client                                 : Disabled

Non Cisco WGB                                  : Disabled

Band Select                                    : Disabled

Load Balancing                                 : Disabled

IP Source Guard                                : Disabled

By default WLAN is configured with WPA2/AES. So if you want to check basic client connectivity you can disable it. Then you should be able to connect your wireless client to this new SSID.

In a separate post we will see how to configure different security methods for a given SSID.

The material is referred from:

Getting Started with 3850

Cisco 2901 router Diagram Specs, features and Benefits overview

Cisco 2901 ISR routers are designed to enable the next phase of branch-office evolution, providing rich media collaboration and virtualization to the branch while maximizing operational cost savings… Additionally, a new Cisco IOS Software Universal image and Services Ready Engine module enable you to decouple the deployment of hardware and software, providing a flexible technology foundation which can quickly adapt to evolving network requirements.

      Overall, Cisco 2901 Integrated Services Router (ISR) delivers highly secure data, voice, video, and application services for small and middle-sized offices. Now, let’s share the diagram for Cisco 2901/K9router.

Cisco 2901/K9 router features overview

 LED area description

·SYS: Solid green ---normal operation.

          Blinking green ---System is booting or is in ROM monitor mode.

          Amber ---System error.

          Off ---Power is off or system board is faulty.

·ACT: Solid or blinking ---any packets are transmitted/received on any WAN/LAN, or when monitoring system activity.

·PoE: Green ---PoE is available.

          Amber ---Power supply is not supplying PoE power.

Cisco 2901/K9 router ports diagram

·ISM: Green ---Initialized.

           Amber ---Initialized with error.

·S (Speed): 1 blink + pause ---GE port operating at 10 Mb/s.

                    2 blink + pause ---GE port operating at 100 Mb/s.

                    3 blink + pause ---GE port operating at 1000 Mb/s.

·L (Link): Green ---GE link is established.

                Off ---No GE link is established. 

Cisco 2901/K9 router back ports overview

Ports Diagram:

·4 integrated EHWIC slots for flexible configurations & support of two modules:

         2 double wide HWIC-D modules;

   OR 4 single wide EHWIC/HWIC modules.

(Each HWIC Slot offers high data throughput capability with up to 1.6 Gbps aggregate towards the router processor and up to 2 Gbps aggregate to other module slots over MultiGigabit Fabric (MGF)).

·1 AUX port (auxiliary port) ---RJ-45 connectors for Remote configuration.

·GE 0/0 & 0/1---Two Gigabit Ethernet ports (RJ-45 connectors).

·2 high-speed USB 2.0 ports enable another mechanism secure token capabilities and storage.

·2 external Compact Flash slots supporting high-speed storage densities upgradeable to 4GB in density.

The original material is from: http://www.router-switch.com/cisco2901-k9-p-155.html

Cisco 1921-K9 & Cisco 1921-SEC-K9 overview & Specs

It's all known that Cisco 1921 builds on the best-in-class. All Cisco 1900 Series Integrated Services Routers offer embedded hardware encryption acceleration, and advanced security services. In addition, the platforms support the industry's widest range of wired and wireless connectivity options such as Serial, T1/E1, xDSL, Gigabit Ethernet, and third-generation (3G) wireless. Now, let’s share Cisco 1921 full and simple tutorial in diagram form.

Cisco 1921/K9 router features

LED area description:

· SYS: Solid green ---normal operation.

          Blinking green ---System is booting or is in ROM monitor mode.

          Amber ---System error.

          Off ---Power is off or system board is faulty.

· ACT: Solid or blinking ---any packets are transmitted/received on any WAN/LAN, or when monitoring system activity.

· PoE: Green ---PoE is available.

          Amber ---Power supply is not supplying PoE power.

 

Cisco 1921/K9 back overview

 S (Speed): 1 blink + pause ---GE port operating at 10 Mb/s.

                    2 blink + pause ---GE port operating at 100 Mb/s.

                    3 blink + pause ---GE port operating at 1000 Mb/s.

· L (Link): Green ---GE link is established.

                 Off ---No GE link is established.  

Cisco 1921/K9 back diagram

 Note: 

· 1 integrated EHWIC slots for flexible configurations & support of two modules: 

         1 double wide HWIC-D or single wide EHWIC/HWIC module; 

         or 2 single wide EHWIC/HWIC module .

(Each HWIC Slot offers high data throughput capability with up to 1.6 Gbps aggregate towards the router processor and up to 2 Gbps aggregate to other module slots over MultiGigabit Fabric (MGF)).

· 1 AUX port (auxiliary port) ---RJ-45 connectors for Remote configuration.

· GE 0/0 & 0/1---Two Gigabit Ethernet ports (RJ-45 connectors).

· High-speed USB 2.0 ports enable another mechanism secure token capabilities and storage. 

Cisco 1921-SEC-K9 overview:

(The back ports overview for Cisco 1921-SEC/K9 is the same with Cisco 1921/K9, thus, we won't list them again)

Cisco 1921-SEC/K9 features and functions

Cisco 1921/K9 & Cisco 1921-SEC/K9 router Specs:

Cisco 1921 Integrated Services Router
Services and Slot Density
Embedded hardware-based cryptography acceleration (IPsec + SSL)	Yes
RJ-45 onboard LAN 10/100/1000 ports	2
EHWIC slots	2
Doublewide EHWIC slots (use of a doublewide EHWIC slot will consume 2 EHWIC slots)	1
Cisco Integrated Services Module (ISM) slots	0
Memory (DDR2 DRAM): Default/Maximum	512 MB/512 MB
USB flash memory (internal): Default/maximum	256 MB/256 MB
External USB flash-memory slots (Type A)	1
USB console port (mini-Type B) (up to 115.2 kbps)	1
Serial console port (up to 115.2 kbps)	1
Serial auxiliary port (up to 115.2 kbps	1
Integrated power supply	AC
Power-supply options	POE (external)
Redundant-power-supply support	No
Power Specifications
AC input voltage	100--240V ~
AC input frequency	47--63 Hz
AC input current range AC power supply (maximum) (amps)	1.5--0.6
AC input surge current	<50A
Typical power (no modules)	25W
Maximum power capacity with AC power supply	60W
Maximum power capacity with PoE power supply (platform only)	70W
Maximum PoE device power capacity with PoE power supply	80W

The original material is from: http://www.router-switch.com/

Best Cisco 800 Series Routers to Prepare for CCNA Exam & CISCO IOS

"What is the best router for learning the Cisco IOS?", or "what is the best router to use to practice for your CCNA exam?", or even, "what is the best router to connect your home or small business to the Internet?” While there are certainly less expensive options that might try to fulfill all three of these needs. In fact, there is one clear answer- the Cisco 800 series routers! Here, we will take a look at what this router line can do and how it can fulfill all of these needs.

What are the basic advantages on Cisco 800 series routers? The Cisco 800 series router lineup is the least expensive and least performance router that Cisco puts their name on (in their current product line up that is).

Cisco 871W router looks like as follows:

Cisco 880 series router

Cisco 880 routers overview

What is the best router for learning the Cisco IOS?

If you want to learn the Cisco IOS are you going to choose a simulator or a router that can't run the latest IOS or the latest features? No, you want to use a router that has the latest and greatest IOS and, most likely, get it at the lowest cost possible.

· The 800 series routers run the Cisco IOS and have most of the latest and greatest features.

· The Cisco 800 series comes in at least 13 different models with varying versions of the IOS on each so take some time looking at the Cisco 800 series model comparison chart before you make up your mind which one to buy.

· There are 800 series routers that connect to all different types of WAN connections - Ethernet (such as to a cable model), ISDN, Serial (such as to a T1 circuit), and G.HDSL/ADSL directly.

· On the LAN side, the 800 series routers support 802.11 b/g wireless and your Ethernet LAN.

· Yes, the 800 series routers have a GUI interface (called the SDM, discussed below) but, candidly, if all you are going to configure the router with is the GUI interface then don't waste your money - buy a Linksys instead. The real power of the 800 series router is the Cisco IOS CLI.

· When it comes to security, Cisco 800 series routers support IPSEC VPN tunnels, VPN remote access, SSL VPN, Stateful firewall, and basic IPS (but make sure you get the right version of the IOS to go on your router - the IOS Advanced Security Image).

So, all in all, the Cisco 800 series router packs a powerful punch.

What is the best router to use to practice for your CCNA exam?

People who are preparing for the Cisco CCNA exam and hope to move on to the CCNP exams at some point need to get at least one router to practice their IOS configurations - both for the hands-on portion of the CCNA exam and just to become competent navigating the Cisco IOS.

cisco 880 routers specs

Cisco 800 may be the very right choice, because it can run the latest and greatest version of the IOS code. To run a version of the IOS that is even remotely current on a 2600, you will need to upgrade it to the maximum amount of Flash and RAM. To do this, you will spend at least $100-$200 on top of what you already paid for the 2600. In the case of the 2500, the latest version of the IOS that any 2500 series router can run is 12.3.x and even then it is only the IP PLUS IOS. To run the IP PLUS with IPSEC/VPN and FIREWALL, you have to go down to IOS version 12.2.

The CCNA exam really isn't that demanding when it comes to what the router needs but if you are going to buy a router to prep for the test, why not buy a router that you could actually use and has all the current features instead of one that.

What is the best router to use to connect your home or small business to the Internet?

While the Cisco 800 series are more complex to configure when compared to a Linksys home/small business router, there is a reason for that. The reason is the number of higher-end features that are offered. Still, the Cisco 800 does offer a decent graphical interface called SDM (deceivingly named, security device manager). 

As you can see, it is a GUI that is similar to a Linksys web-based interface. As the router can do a lot more than a Linksys router or SDM can do. However, unlike Linksys routers, not everything can be done in the GUI interface. Eventually, you will have to go to the IOS CLI and learn how to use it.

Cisco 800 series routers are the least expensive Cisco routers that run the full Cisco IOS. They also pack a ton of wireless, routing, and security features into a small package. While Cisco doesn't need my help to sell routers, I am recommending the 800 series Cisco router to those of you out there where it makes a good fit.

The original material is from: 

http://www.cisco1900router.com/which-is-the-best-router-for-preparing-ccna-exam-cisco-ios.html

Best choice for network security---Cisco ASA firewall

Without firewall, without network security for business

No matter for businesses or home networks systems, keeping network secure is a constant struggle in this modern world. You may be doubt at my conclusion, but the following reasons will tell you the reason:
1. Make sure anti-virus software is uploaded on every computer for third-party software such as Java, Adobe products and browsers are often gateways for malware.

Cisco ASA 5505, Cisco ASA 5510, Cisco ASA 5580

2. PCs, tablets, switches and routers all need to be constantly updated and monitored to guard against network threats. Using a remote monitoring and management (RMM) tool that includes the ability for both operating system and third-party patching makes this process easy for a solution provider to update all software on an endpoint. （Juniper’s Care Plus and Cisco’s Smart Care are two examples. Those initiatives help solution providers ensure their entire customer networks are healthy, offer access to vendor technical support and also provide reporting on a scheduled basis.）
3. Be sure to change the default administrative password on the new devices such as wireless router, which is typically "password." If possible, create a new administrative user id, and disable the default, which is typically "admin." Perform all administration and configuration tasks through the LAN cable interface.
4. Pay attention to data encryption. Choose the highest encryption level that your computing equipment can support, and choose a pass-phrase that is easy for you to remember but hard for outsiders to guess.

 Basic functions of firewalls

Firewalls primarily provide access control for connections between networks. Usually this will be the connection between a corporate network and the Internet.

Normally, the LAN is allowed to access the WAN and DMZ which is allowed to access the WAN on certain ports for certain services determined according to your security policies. Services not explicitly allowed are blocked. And the WAN is allowed to access the WAN and DMZ on certain ports for certain services. (For example a Mail server in the DMZ may be allowed to access a few DNS servers on port 53 only; also it would be allowed outgoing access to any SMTP server on port 25. Incoming access would be on POP3, port 110. )

functions of Cisco ASA 5500 firewall

A setup as described above provides

1) Excellent security from external threat

2) Control the connections that LAN pcs are allowed out to the WAN

3) Proper utilization of expensive bandwidth

4) Full speed access to internal and external resources

Advantages of Cisco ASA Firewalls

1. Cisco ASA is a new safe appliance firewall against malicious software.

2. Cisco ASA series are all 5500 series including 4 Enterprise versions: Firewall, IPS, Anti-X, and VPN; and there are business versions for those middle or small and medium-sized companies.

3. On the whole, Cisco ASA has 5 models, and they all use ASA .7.2.2 software.

4. ASA provides IPS (intrusion prevention system) and VPN concentrator; in fact, it can replace the 3 independent devices: Cisco PIX firewall, Cisco VPN 3000 series concentrator and Cisco IPS 4000 series sensor.

Buy Used Cisco Equipment or New Cisco Network Hardware?

It’s so magic to contact with friends all over the world. However, how our network works? Generally, it is usually composed of devices; take the leading supplier Cisco as example, including Cisco routers, switches,  Cisco ASA firewalls and even Cisco power supply and Cisco cables. All of these different types of networking hardware come with a price tag that can lead to quite an extensive expense. Some business owners prefer to buy new knowing their hardware will be guaranteed to work while others will buy used to save on the price.

However, you will discover yourself wondering why you bought Cisco used equipment instead of new network hardware after reading the following:

Cisco used equipment

1.When buying used Cisco hardware, you can generally save 50% off or more compared to new.

2.Network resellers often have better customer support so you can actually speak to a human being without being charged for it.

3.Most popular network resellers offer warranties that rival any manufacturer warranty.

4.A new Cisco device will become used as soon as you open the box. Therefore, you could have done some homework to find how many locations the Cisco device was used before it comes into your possession.

5.Not only on price, but the best network resellers test the equipment to ensure it works saving you a headache.

6.When buying used Cisco hardware, you are preventing the device from ever touching a landfill. Electronic devices contain harmful materials that are dangerous to wildlife and environment in general.

7.Your boss will praise you for saving the company money by using your brain.

8.Network equipment resellers will offer you other used networking hardware solutions to ensure your network receives the best choice on product.

9.When dealing with Cisco equipment, there is an exception to the "buying new" rule. GBICs can be purchased as compatible for the manufacturer's product at a less expensive price.

10.You can take the money you saved your company and give your employees a surprise bonus increasing moral.

The 10 reasons above of buying used Cisco hardware instead of new Cisco network equipment may let you no hesitate to choose used one. Also purchasing new Cisco equipment, such as some advanced Cisco routers, switches or Cisco modules, will be considered by some large enterprises because of higher networking requirement and better networking solutions and service. These can be easily received from buying new Cisco network hardware. So new or used Cisco, that depends on your networking need and requirements.