Upgrading your MSE (Licenses change)

I am writing this for myself and anyone else that might be upgrading your MSE 3355 in the future.  I found the two documents (links will need CCO account) below, but my varied a little – so here goes.  I went with the first option, since I didn’t require data migration.

 

http://tools.cisco.com/squish/B7496

 

http://tools.cisco.com/squish/F1136

 

Step one was to “back up the existing database using the Prime Infrastructure.”  There was no link or other direction on how to do this, and I didn’t feel the need, so I didn’t do it.  A link to how to do it would have been nice, however.  I believe they wanted you to log into Prime Infrastructure and go here:

Services > Mobility Services Engines > smonmsep01 > System > Maintenance > Backup Operation

 

Step two and three was Transfer the *.tar file fro 7.4.110.0 to the MSE appliance and place it in the /opt/installers folder.

The step said to use “CISCO-MSE-L-K9-7-4-110-0-64bit.db.tar”. 

 

I found the file to be named “CISCO-MSE-L-K9-7-4-110-0-64bit.bin.gz” on CCO, which I downloaded.  I used WinSCP to simply and painlessly FTP the file from my desktop to the MSE.  You’ll need the username, password and IP address of your MSE.

 

 

 

Step four was to decompress the file.  I used TeraTerm to SSH into the appliance.

 

[root@CiscoMSE /]# cd opt

 

[root@CiscoMSE opt]# ls (next step change to OPT)

data  installers  lsi  MegaRAID  mse  oracle  ORCLfmap

 

[root@CiscoMSE opt]# cd installers

[root@CiscoMSE installers]# ls

CISCO-MSE-L-K9-7-0-201-204-64bit.bin.gz  database_installer_part2of4.zip

CISCO-MSE-L-K9-7-3-101-0-64bit.bin       database_installer_part3of4.zip

CISCO-MSE-L-K9-7-4-110-0-64bit.bin.gz    database_installer_part4of4.zip

database_installer_part1of4.zip 

 

The directions stated step four was to “Untar the file: tar -xvf CISCO-MSE-K9-7-4-110-0-64.bit-db.tar”. 

My file was .gz, so I skipped that step and when right to gunzip.

 

Now we can actually unzip the file with the gunzip command.  

 

[root@CiscoMSE installers]# gunzip CISCO-MSE-L-K9-7-4-110-0-64bit.bin.gz

[root@CiscoMSE installers]# ls

CISCO-MSE-L-K9-7-0-201-204-64bit.bin.gz  database_installer_part2of4.zip

CISCO-MSE-L-K9-7-3-101-0-64bit.bin       database_installer_part3of4.zip

CISCO-MSE-L-K9-7-4-110-0-64bit.bin       database_installer_part4of4.zip

database_installer_part1of4.zip

 

Next we change the permissions of the file so we can execute the installation.

 

[root@CiscoMSE installers]# chmod +x CISCO-MSE-L-K9-7-4-110-0-64bit.bin

 

Now stop the MSE.

 

 

[root@CiscoMSE installers]# service msed stop

Stopping MSE Platform

Shutting down framework and services ...

Shutting down framework and services ....................

Flushing firewall rules: [  OK  ]

Setting chains to policy ACCEPT: nat filter [  OK  ]

Unloading iptables modules: [  OK  ]

 

The next step was to uninstall the existing MSE software.  There were no directions, links, etc, on how to do it, so I skipped that step and went to the next one, which was “invoke the MSE Installer”.  I will also include the output of the CLI just as a reference.  This took less than a half hour to complete.

 

[root@CiscoMSE installers]# ./CISCO-MSE-L-K9-7-4-110-0-64bit.bin

Preparing to install...

Extracting the JRE from the installer archive...

Unpacking the JRE...

Extracting the installation resources from the installer archive...

Configuring the installer for this system's environment...

 

Launching installer...

 

Preparing CONSOLE Mode Installation...

 

===============================================================================

Cisco Mobility Services Engine    (created with InstallAnywhere by Macrovision)

===============================================================================

Introduction

 

InstallAnywhere will guide you through the installation of Cisco Mobility

Services Engine.

 

It is strongly recommended that you quit all programs before continuing with

this installation.

 

Respond to each prompt to proceed to the next step in the installation.  If you

want to change something on a previous step, type 'back'.

 

<read this carefully>

 

Licensing on the Mobility Services Engine is enforced with the release of

software version 6.x and greater. Please have the Product Authorization Key

(PAK) and refer to the instructions in the User Guide to enable licensing.

 

PRESS <ENTER> TO CONTINUE:

 

===============================================================================

Installing MSE version: 7.4.110.0

===============================================================================

Installation Check

------------------

The system appears to have a Cisco Mobility Services Engine already installed.

If you choose "Continue", all the currently installed components will be

removed permanently (Only database and license files will be preserved).

 

  ->1- Exit

    2- Continue

 

ENTER THE NUMBER OF THE DESIRED CHOICE, OR PRESS <ENTER> TO ACCEPT THE

   DEFAULT: 2

===============================================================================

Current Role - Primary

----------------------

 

High Availability Role is currently set to Primary from previous installation.

 

If need to change role to Secondary or re-configure high availability settings,

please execute setup.sh after installation is completed.

 

PRESS <ENTER> TO CONTINUE:

 

===============================================================================

MSE Startup

-----------

 

Would you like the Cisco Mobility Services Engine to startup automatically at

system boot up?

 

  ->1- Yes

    2- No

 

ENTER THE NUMBER OF THE DESIRED CHOICE, OR PRESS <ENTER> TO ACCEPT THE

   DEFAULT: 1

 

===============================================================================

Pre-Installation Summary

------------------------

 

Please Review the Following Before Continuing:

 

Product Name:

    Cisco Mobility Services Engine

 

Install Folder:

    /opt/mse

 

Link Folder:

    /tmp

 

Disk Space Information (for Installation Target):

    Required:  2,570,778,828 bytes

    Available: 497,276,530,688 bytes

 

PRESS <ENTER> TO CONTINUE:

 

===============================================================================

Installing...

 

[==================|==================|==================|==================]

[------------------|------------------|------------------|------------------]

 

===============================================================================

Database Installation

 

The installer will now install the database. This may take a long time (up to

30 minutes). Do not cancel the installer.

 

PRESS <ENTER> TO CONTINUE:

 

===============================================================================

!!!! IMPORTANT NOTE !!!! :

--------------------------

 

The system is minimally configured right now. It is strongly recommended that

you run the setup script under /opt/mse/setup/setup.sh to configure all

appliance related parameters immediately after installation is complete.

 

The hostname must be set correctly on the system. The Cisco MSE platform will

NOT start if it is configured incorrectly or not configured at all.

 

Additionally, it is strongly recommended that the Cisco MSE be configured to

use the same NTP servers as the controllers with which it will be synchronized.

This is essential to the correct operation of the Cisco Mobility Services

Engine.

 

Both these parameters may be configured as part of the setup script.

 

PRESS <ENTER> TO CONTINUE:

 

===============================================================================

Installation Complete

---------------------

 

Congratulations. Cisco Mobility Services Engine has been successfully installed

to:

 

/opt/mse

 

Licensing on the Mobility Services Engine is enforced with the release of

software version 6.x and greater. Please have the Product Authorization Key

(PAK) and refer to the instructions in the User Guide to enable licensing.

 

PRESS <ENTER> TO EXIT THE INSTALLER: [root@CiscoMSE installers]#

 

Just a note about this:  I didn’t see the MSE come back to life.  I had to restart the service.  Command is “service msed start”

 

[root@CiscoMSE /]# service msed start

 

Starting MSE Platform

 

Flushing firewall rules:                                   [  OK  ]

Setting chains to policy ACCEPT: filter                    [  OK  ]

Unloading iptables modules:                                [  OK  ]

Starting Health Monitor, Waiting to check the status.

Health Monitor successfully started

Starting Admin process...

Started Admin process.

Starting database ....

Database started successfully. Starting framework and services .................

Framework and services successfully started

[root@CiscoMSE /]#

 

Now to check with Prime Infrastructure – which was just upgraded to 2.0 several days ago. (the reason for this upgrade)

 

 

 

Here’s a screenshot from this link:

 

http://www.cisco.com/en/US/docs/wireless/mse/3350/release/notes/mse_7_4_110_0.html#wp1233900

 

 

 

 

 

 

 

 

 

How to block Bit torrent on your WLAN

I came across an interesting feature I would like share on the 7.4 version of Cisco 5508 WLAN controller.

 

I was asked to block bit torrent, audio and voice streaming on the guest WLAN for obvious reasons.  The old way, doing it on a firewall or with an ACL on the WLAN controller was rather clunky at best.

 

If you are either on 7.4 or can jump to it, here’s all it took to turn on this nifty feature.

 

Here’s the flavor of code that I’m running:

 

 

Browse to Wirelessà Application Visibility And Control à AVC Profiles and select NEW.

 

 

 

Next come up with a name that fits your organization.  I’ll call mine “WLAN Restrictions” because there will be a list of things and not one single application.  Your mileage may vary, of course.

 

After you create the Profile, click on it and you will see that there are no rules associated with the profile.

 

 

Look over to the right hand side of the screen and click on “Add New Rule”…

 

This way is kind of clunky, but I will go ahead with explaining it.  To block Audio, you have to select “voice-and-video” as the Application Group and then select the Application Name.  In this case, I selected “audio-over-http” and then selected Drop as the action.

 

Now you can add another rule.  But this time we’re going to go a different way.  We want to block bit torrent, but we don’t know which Application Group it is in.  This time, browse to Wirelessà Application Visibility And Control à AVC Profiles and select AVC Applications.

 

 

This time,

 

 

Scroll down and click “bittorrent” and then use the AVC Name Drop down and select the Application Profile you created in the first step and select Ddrop as the action.  Drop is the default, so you really don’t have to do anything.

 

 

Now browse to the WLAN you want to apply the AVC Profile to.  I’m sure you know where it is, but in case you forgot, browse to WLANSà WLANsà WLAN ID (of the WLAN Profile) and then browse to the QoS tab.  Select the AVC Profile and apply.

 

That’s it.  You’re finished.  Don’t forget to save your config! 

 

Wall mounting vs. Ceiling mounting your access points

This post stems from the knowledge of how to properly mount your access points.  I recently went to do a validation survey for a 5 GHz WLAN, and discovered two of the three access points were mounted on the wall, perpendicular to the floor.

 

I decided to survey it anyway, and then remount the access points another day when I had the appropriate hardware, and re-survey.  I wanted to see what the actual coverage pattern would be – a “before and after”, if you would like to think of it that way.

 

Here is the coverage of the floor before making any changes.  The green and purple coverage patterns are created by two access points mounted “incorrectly”.  They’re both hanging like wall clocks, instead of being mounted on the ceiling like UFOs.  The brick colored pattern is mounted horizontally, and no change was made to this access point.

 

 

Here is the overlapping coverage in red.

 

 

I remounted the green access point horizontally about 3 feet from the telepole where it had been mounted vertically.  The “purple AP” I had to move from the hallway into the room next to the stairwell since there was no ceiling or structure to mount it to in the hallway. 

 

 

This is the “after” overlapping coverage area.

 

 

I must admit that I expected something a little more dramatic.  I used the same laptop, the same adapter, and walked the same path on both surveys.

 

I’m interested if anyone else has done any comparison surveys like this, what did they show?

 

 

 

 

 

 

 

Offloading your guest WLAN onto local cable/DSL/FiOS

This is the first post of several posts describing how to offload your guest WLAN internet traffic from your backbone and out a local internet provider.  Why would you want to do this?  If you have a corporate WLAN and are tunneling your guest traffic over the leased lines, your guest traffic could quite easily exceed your production traffic.

 

First of all, you may be tempted to use the DHCP server on the ASA5505 appliance.  Although this can be done, it would be nice if you could use your corporate DHCP services that are already in place.  Let’s start at the bottom – as if you have never administered a Windows DHCP server and go all the way to the end – with offloading your traffic.  Note – this the first of several blog posts.

 

First, this post explains how to install the admin pack for Windows 7 machines and start using it.  This will allow you to manage the DHCP server function that runs on the Windows 2003/2008 servers.

 

Administration pack tools do not come with Windows 7. You have to download it from Microsoft site and install it.  This administration tools pack allows you to do most of the Windows 2003, Windows 2008 and Windows 2008 R2 server tasks from your Window7 computer.

 

DHCP manager is one of the admin pack tools to manage DHCP servers and it allows you to do it right from your workstation.  Installing Admin or administrators pack on Windows 7 is slightly different than earlier versions of Windows.

 

Steps for installing Admin pack on Windows 7 Professional, Enterprise, or Ultimate editions.

 

Download the server administration pack here:  http://www.microsoft.com/en-us/download/details.aspx?id=7887

 

After downloading, Start the installation. Yes for Install update.

 

 

Once successfully installed, next screen shows how to install each feature of admin pack tool.  Without doing the following steps you can’t find any of the administration tools in program files or control panel. Close the screen and go to control panel. 

 

Go to Programs and features. Select Turn Windows features on or off then select Remote Server Administration Tools as shown below. (blue and yellow icon)

 

 

 

You must be in administrator group or administration tasks privilege should have been given to perform some of server tasks. In this example I select DHCP server Tools which help to manage multiple DHCP servers from my Windows 7 computer.

 

Press OK.

 

The newly added administrative pack tool feature can be found under Administrative Tools in Windows 7. (your window may look differently than mine)

 

Now we are going to add a DHCP server so we can add a new DHCP scope.

 

Click on Administrative Tools.

 

 

 

The  Administrative Tools window pops up:

 

 

 

Double click DHCP and the following window pops up:

 

 

 

Click on Action -à Add Server….  (sorry for the blur – it was necessary in this case)

 

 

Choose the existing DHCP server that you want to create a DHCP scope on.  In this example, I am creating a scope for the guest wireless internet users in our fictitious Redmond, WA, office.

 

 

 

The DHCP server has now been added so you can be an Administrator.

 

 

Now I am going to create a new DHCP scope.

 

Next, click on Action à New Scope… and the “Welcome to the New Scope Wizard box pops up”.

 

 

 

 

Click Next and Enter in the name of the scope you are creating.

 

 

 

Click Next and enter in the range of IP addresses that you want to hand out.

 

 

 

 

Click Next and enter in any IP addresses you do NOT want to hand out.  You might need this if you have some static IP addresses somewhere on the subnet.  In this example there are not exclusions.

 

 

 

Click Next.  I am setting up the lease time for two hours since the guest network is for transient clients.

 

 

 

Click Next.  You will need to set up some options, such as the DNS server and gateway you want the clients to use.

 

 

 

Click Next, and enter is the router’s IP address that you want the clients to use as their gateway.

 

 

 

Click Next.  This one is tricky.  Since the guest network is not on the production network (and tied to a DSL/Cable/FiOS circuit) you will not want to use the corporate DNS servers which are inside your network since they will not be reachable by the client devices.  In this example, I am adding 8.8.8.8, which is Google’s public DNS servers.  They are accessible from the circuit outside of the network – and most likely your home, too!

 

 

 

Click Next… nothing to do here.

 

 

 

 

Click Next.  Yes, you want to activate the scope now.

 

 

 

Click Finish.  Now you’re done.

 

 

 

Now you are finished.  If your network is all built and clients are waiting, you can browse to the scope you just created and look at the Address Leases folder.  In the middle pane you should see new leases being handed out.

 

 

 

Congratulations!

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Disabling 6 and 9 mb/s Cisco 1310 bridges

We all know the benefits of trimming off 802.11b from your 2.4 GHz network.  The task is quite easy, so here goes:

 

I trimmed off 802.11b entirely with the command:

 

interface Dot11Radio0

speed only-ofdm

 

I then attempted to trim off the lower two OFDM data rates.  I consulted the manual on how to do so, and here is what I found: (READ VERY CAREFULLY)

 

 

 

and entered in the following command:

 

interface Dot11Radio0

no speed basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0

 

The result was that all data rates were disabled except 6 & 9 mb/s.

 

Show run:

!
interface Dot11Radio0
!
 speed  basic-6.0 basic-9.0

 

The command entered to disable the lower two data rates actually did the opposite!

 

Here's the "fix" - or what worked for me.

config t

interface Dot11Radio0

speed basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0 (restored it the way it was)

no speed basic-6.0 basic-9.0 (removed the lower two data rates)

 

The "fix" is the way I would have done it in the first place, until I found the manual and read it.  Did I interpret the manual incorrectly?

 

 

How to add AP licenses to a Cisco 5508 WLAN controller

How to add AP licenses to a Cisco WLAN controller.

I recently had to do this and I must say if I had the link (below) when I first started out, life would have been much easier.

You should have a PAK from Cisco when you purchased your adder license.

 

Go to https://tools.cisco.com/SWIFT/LicensingUI/Home and register it with the controller.

 

 

 

 

In this case, the PAK is 3681J1B047A.

 

You are going to need the serial number of your controller in order to generate the license for it.  I SSH into the controller and issue either "show udi" or "show license udi".  Just make sure you are communicating with the controller you intend to upgrade licenses on!  I am sure there are other ways to get this information, but this is how I do it.

 

 

After you enter in the information, you can view and download your licenses, or wait for them to arrive via email.  I downloaded the two license files in this example since I am adding licenses to two controllers.

 

 

After downloading the file to your computer, extract the file into a directory and place the files into your tftp folder for uploading into the controller.

 

 

 

You'll notice the file is named with the serial number of the controller and the date.  This should give you a hint to which file should be uploaded to your controller.

 

Browse to your controller to view the current licenses:

 

 

 

I'm a believer in backing up your controller before doing any upgrades to it.  I am going to backup the license files, save the current configuration (you will have to reboot the controller and you don't want to lose any changes) and also backup the configuration.

 

I use the 3CDaemon tftp server since it is freeware and handles larger files:

 

 

Use a logical name for the backup of your current licenses. 

 

 

You'll know the controller licenses have been backed up by looking at both the tftp server and the GUI of the controller.  Remember to name the backup to something you can decipher 5 months from now.

 

 

Now install the new license.  The syntax is tftp://<tftp server IP address>/<filenameYouDownloaded.lic>

 

Don't forget to add the ".lic" to the filename!

 

 

 

 

Verify at your TFTP server:

 

 

After the license is installed, you are informed you will need to reboot the controller.  Note that pressing OK does NOT reboot your controller.

 

 

You might want to verify that your controller has the new licenses on the Licenses page:  I did, and it is there.  Notice how the new 150 AP license now shows that it is in use.

 

 

 

Now save the configuration before you reboot the controller:

 

 

 

Press OK to save the configuration.  Now save the config to your tftp server before you reboot.  The default name of the file is good enough for me, since it is the IP address of the controller

 

 

Verify at your TFTP server:

 

 

Now you can reboot the controller.  I am going to schedule a reboot for a weekend.  Enter in the date, time and leave the image set to normal and then click reboot.  You will be informed via the gui the controller will reboot at the time/date you entered.

 

 

You are now done adding licenses to your controller.