Thursday, September 23, 2010

H-REAP Feature Matrix

Following up on my previous two posts on Cisco's H-REAP distributed forwarding mode of operation for lightweight access points, Cisco has recently published a feature matrix for the H-REAP access point mode of operation. The matrix applies to the latest version 7.0.98.0 of wireless LAN controller code.

Some notable items include:

  • No PMK/OKC/PKC fast roaming support.
    This is a big disappointment, especially considering H-REAP does support Cisco's proprietary CCKM fast roaming. Hopefully they're working on this as well as 802.11r Fast BSS Transition support.

  • No Spectrum Intelligence on 3500 series APs.
    Considering this is built into the AP and is not a controller function, lack of support is surprising. I can see why reporting and trending through the WLC and WCS would be interrupted in standalone mode, but I would think spectrum intelligence base functionality should be available for admins to connect remotely to the AP and analyse the airspace.

    Update: Just to clarify, CleanAir spectrum intelligence does work in H-REAP connected mode, but does not work in H-REAP standalone mode since the WLC aggregates and reports on the interference data.

  • No Workgroup Bridge support
    I was not aware of limitation previously! If you support autonomous WGBs, then H-REAP is NOT the solution for you at this point.

  • Supports DFS/TPC (802.11h) even in standalone mode
    This is critical to maintain compliance with FCC regulations to avoid radar in the 5GHz band. Kudos to Cisco for being one of the few vendors with support for DFS channels, allowing administrators greater spectrum to work with to increase client and network capacity.

Overall, a few interesting new findings in this document. It is definitely not comprehensive though, so don't use this as your only source for H-REAP feature support. Check our my previous blog post for a more thorough listing compiled from multiple Cisco document sources as well as real-world testing.

-Andrew

Monday, September 20, 2010

Update: WLC Upgrade Issue Affects 11n Data Rates

Update Sep. 20, 2010: Cisco has created new bug ID CSCti89945 for this issue. See my original post on this issue here.

CSCti89945 Bug Details

wlc upgrade to 7.0.98.0, N breaks requires wlan deletion-readdition.

Symptom:

when a wlc is upgrade from say 4.2.176.0 or later to 7.0.98.0 the wlans do not work with the N rates. a/b/g regular rates work on N capable clients

Conditions:

Issue is seen specifc to N rates when upgrade from lower versions to 7.0.98.0

Workaround:

Delete the WLAN and recreate or add the WLANs back for N rates to start working on wlc.

-Andrew

Wednesday, September 15, 2010

PEAPv0 Packet Flow Reference

I have created a handy reference for understanding the packet flow of a PEAPv0 / EAP-MSCHAPv2 authentication exchange.

Included are packet flows for three different authentication scenarios:

  1. Full initial authentication exchange
  2. Full initial authentication exchange including Active Directory services
  3. TLS session resumption (also called fast reconnect)

Here is a preview:

You can download the full version here. I hope you enjoy it and find it useful!

-Andrew