airwaves Forum: Recent Posts

wnelsen on "What version of CentOS is AMP running on? Do I need to upgrade?"

wnelsen — Tue, 07 Jul 2009 01:14:27 +0000

In a thread related to another topic a customer asks:
...is 6.3.3 still running the ancient version of CentOS or the new one? What is the risk of upgrading and is there a possibility of rolling-back to previous version if needed?

Answer:
AWMS 6.3 is bundled with CentOS 5.3. AWMS 6.3 and later versions will not run on CentOS 4.

There are always risks in moving from one version to another, but we usually recommend staying as close to the most recent version as possible to minimize the delta. "Rolling back" is something we do not recommend doing, but a backup is taken as part of the upgrade process in case you choose to do that.

Please refer to the AirWave Downloads page for Release Notes and Hardware Sizing Guide to help you decide.

http://airwave.com/support/download/index.php

You might also refer to the following article in the AirWave Knowledge Base:
Do I need to upgrade to CentOS 5.3? If so, how do I upgrade?
http://kb.airwave.com/?sid=50140000000MoQo

wnelsen on "Various authentification types"

wnelsen — Tue, 07 Jul 2009 01:02:07 +0000

snoel-SA, AWMS 6.3 is bundled with CentOS 5.3. AWMS 6.3 and later versions will not run on CentOS 4.

Please refer to the AirWave Downloads page for Release Notes and Hardware Sizing Guide to help you decide.

http://airwave.com/support/download/index.php

You might also refer to the following article in the AirWave Knowledge Base:
Do I need to upgrade to CentOS 5.3? If so, how do I upgrade?
http://kb.airwave.com/?sid=50140000000MoQo

mga@uni-c.dk on "RADIUS authentication of AWMS users"

mga@uni-c.dk — Fri, 03 Jul 2009 13:27:47 +0000

Thanks. Exactly what I was looking for!

snoel-SA on "Various authentification types"

snoel-SA — Fri, 03 Jul 2009 07:55:07 +0000

Hello,

Did our logs helped you for fixing this issue ?
By the way, is 6.3.3 still running the ancient version of CentOS or the new one ? What is the risk of upgrading and is there a possibility of rolling-back to previous version if needed ?

Best regard.

dancomfort on "RADIUS authentication of AWMS users"

dancomfort — Wed, 01 Jul 2009 17:40:59 +0000

Aruba-Admin-Role is the attribute. I'm not sure what type of RADIUS server you're using; in a freeradius config, you'd have something like this for the user jane:

jane User-Password := "password123"
Aruba-Admin-Role = "AMP Administrator"

mga@uni-c.dk on "RADIUS authentication of AWMS users"

mga@uni-c.dk — Wed, 01 Jul 2009 00:50:35 +0000

I think it should be possible to use an external RADIUS server to authenticate AWMS users.

But how do we authorize the users through radius. Which radius attribute is used to map the user to role in AWMS?

dancomfort on "Various authentification types"

dancomfort — Tue, 30 Jun 2009 10:53:21 +0000

We have a fix for this issue in our 6.3.3 release which is available now. Once you upgrade, all EAP users will display the auth type correctly after the first poll (instead of after the second poll).

Dan

nikhil9 on "Getting user details connected to a particular SSID"

nikhil9 — Thu, 25 Jun 2009 20:02:39 +0000

Donster,

Hurray it worked, appreciate the help
Is c.mac the name for the column of mac-address and v.username the notification for username

Thanks
NikhiL

donster on "Getting user details connected to a particular SSID"

donster — Thu, 25 Jun 2009 09:50:34 +0000

Try this:

select c.mac, v.username from client c, vpn_user v where c.mac=v.mac and c.ssid='whatever_ssid_u_want';

nikhil9 on "Getting user details connected to a particular SSID"

nikhil9 — Thu, 25 Jun 2009 04:29:02 +0000

Dan

The info you gave me, gives all the user details. I am looking specific to a WLAN,

Thanks
NikhiL

dancomfort on "Getting user details connected to a particular SSID"

dancomfort — Wed, 24 Jun 2009 11:27:11 +0000

The MAC address of every connected user is definitely in the database. The username is in the database if the AMP knows the username. And that information is available on our web interface, under the users tab. If you want a way to get it from the database, you could do this:

=> select c.mac, v.username from client c, vpn_user v where c.mac=v.mac;

donster on "another requested master console 'hack'"

donster — Wed, 24 Jun 2009 04:47:57 +0000

Roger that red leader. Thanks!

nikhil9 on "Getting user details connected to a particular SSID"

nikhil9 — Wed, 24 Jun 2009 04:10:30 +0000

Friends,

Is it possible to get the details of the user details connected to a particular SSID from the database, I am looking for the username, MAC details of the client

Thanks
NikhiL

dancomfort on "another requested master console 'hack'"

dancomfort — Tue, 23 Jun 2009 17:32:30 +0000

donster,

That change isn't as easy as you might think (or as easy as I might have thought). The MC gets those links from the AMPs, so we'd have to change code on every AMP. And it wouldn't be an easy change to make unless we wanted to break some other stuff.

I would encourage you to click the red feedback button on the left page of this forum and submit a feature request. :-)

dancomfort on "email-alert"

dancomfort — Tue, 23 Jun 2009 14:21:14 +0000

Nikhil,

It's expected that the links in email alerts will not work with a bonded ethernet configuration. If you're interested in a patch that will work with your version of AMP, I think I can do that for you.

donster on "another requested master console 'hack'"

donster — Tue, 23 Jun 2009 11:59:06 +0000

Surely someone knows which file these urls are built from :)

nikhil9 on "Updating SNMP missed threshold"

nikhil9 — Tue, 23 Jun 2009 11:34:52 +0000

Dan

Thanks for the help, it worked :-)

Can you tell me when do I give the "root; make" command. Is it when I make some changes in the code ?

Thanks
NikhiL

dancomfort on "Updating SNMP missed threshold"

dancomfort — Tue, 23 Jun 2009 09:05:02 +0000

That's close, but the syntax is more like this:

airwave=> UPDATE ap_group SET ap_down_threshold = 3;
airwave=> \q

You don't need to do a make after this change.

nikhil9 on "Updating SNMP missed threshold"

nikhil9 — Mon, 22 Jun 2009 20:15:44 +0000

I see from the WEB-GUI the below 2 parameters
Missed SNMP Poll Threshold (1-100):
Up/Down Status Polling Period
I would like to update" Missed SNMP Poll Threshold (1-100)" value.
I applied the command as below
airwave=>UPDATE ap_group SET ap_down_threshold 3
airwave=>\q
amp#root; make
let me know if the procedure I did was correct, since I couldnt find any change after executing the command
Thanks
Nik

nikhil9 on "email-alert"

nikhil9 — Mon, 22 Jun 2009 19:55:24 +0000

Dan,

I am using bonded interface, and not an eth0 interface

Thanks
Nikhil

dancomfort on "email-alert"

dancomfort — Mon, 22 Jun 2009 16:12:17 +0000

nikhil,

In current versions of the AMP, the address in alerts is the hostname (or ip address) of the eth0 interface. Are you using bonded interfaces or some other configuration where AMP shouldn't use eth0?

Dan

dancomfort on "Updating SNMP missed threshold"

dancomfort — Mon, 22 Jun 2009 15:17:14 +0000

donster is correct. The command in the database would be:

=> update ap_group set ap_down_threshold=<x>;

donster on "Updating SNMP missed threshold"

donster — Mon, 22 Jun 2009 08:21:01 +0000

I'm going to guess it's set in the ap_down_threshold column from the ap_group table. All my groups show it set to 1.

nikhil9 on "Updating SNMP missed threshold"

nikhil9 — Mon, 22 Jun 2009 07:00:51 +0000

Friends

Can anybody help with the options to update the "Missed SNMP Poll Threshold" for all the groups in one-shot, similar to "update ap_group set poll_period_dot11_counters = 0"

Thanks
Nik

nikhil9 on "email-alert"

nikhil9 — Mon, 22 Jun 2009 06:06:59 +0000

Hi Don,

I checked both, but in both places the name is given correctly "https://12345amp.com/ap_monitoring?id=1877".

Thanks
Nik

donster on "email-alert"

donster — Mon, 22 Jun 2009 05:02:00 +0000

It's my understanding that AMP picks this value up via the AMP Setup / Network page under hostname. Might also be worth comparing with the output of uname -n

nikhil9 on "email-alert"

nikhil9 — Mon, 22 Jun 2009 04:10:20 +0000

Friends,

I have configured trigger emails to be send to the various managers for the DEVICE DOWN ALERT. The link for ap is shown wrongly in this.
For "https://12354amp.com/ap_monitoring?id=1877" is the link-id coming for the ap-down alert, where in actually is should have been "https://12345amp.com/ap_monitoring?id=1877".

Let me whether this can corrected if I change the name in /etc/hosts
Thanks
Nik

donster on "another requested master console 'hack'"

donster — Fri, 19 Jun 2009 04:58:15 +0000

I love the ability to see all my down devices (/ap_down_list) across the whole enterprise on the master console (6.2.3). With 28k devices under mgmt, there are a fair number that fall off each day and by policy, I delete them after a week of being mia. If I could change only one thing, I'd want the url provided to go straight to the ap_manage page rather than the ap_monitoring page for each down device (so I can DELETE them) :) I have vim armed and ready. Where's the code to modify the link master console builds? Thanks!

madransom on "Various authentification types"

madransom — Thu, 18 Jun 2009 15:50:14 +0000

dancomfort: after looking a bit more, it appears that the 'authenticated by ap' only exists when the user's duration is <2 minutes. I believe I poll the controllers every 2 minutes or so, so what you suggest might be the case.

dancomfort on "Various authentification types"

dancomfort — Thu, 18 Jun 2009 12:41:11 +0000

madransom, how long have the users been associated who are "Authenticated by AP"? Is it possible that they have all very recently associated? I think it's possible that the AMP doesn't always get the right auth type when it first sees a user, and if that's the case, I think it's something we might be able to fix.

madransom on "Various authentification types"

madransom — Thu, 18 Jun 2009 08:58:28 +0000

My setup is strictly Aruba based with a pair of 2400 controllers and Aruba65 APs. The users that show the 'Authenticated by AP' share the same SSID, VLAN, and roles as the rest of the users and its not confined to a single AP. Actually the 3 users I see right now that are authed in this manner are all on different APs.

snoel-SA on "Various authentification types"

snoel-SA — Mon, 15 Jun 2009 07:30:31 +0000

Hi,

In addition to that, I just checked some precise data on the AMP user array:
For the site/folder that interests us, all users connect via the same SSID, all in the same VLAN, and the authentification type is of 3 kind :
- Authentificated by AP
- Authentificated by AP (EAP-PEAP)
- WPA-PEAP

One of the AP has 3 users connected : 2 for which the type is "Authentificated by AP (EAP-PEAP)", the remaining one for which the type is "Authentificated by AP".
Other AP has several users connected with several types too.
I don't see any AP that has 2 users shown as connected the same way, unfortunately.

Regards.

snoel-SA on "Various authentification types"

snoel-SA — Mon, 15 Jun 2009 06:03:42 +0000

Hi,

Let me talk about one of our client sites, where Wifi is implemented.
Overthere, all AP are Cisco 1240 series with firmware 12.3(8)JEC. The authentification is done via a remote ACS. AP and ACS radius server are on different LAN/VLAN (1 different VLAN for each group of AP, servers, client devices).
Unfortunately I don't know the exact configuration of the access point so I cannot give a lot of details. However the only things I'm sure about, it's that all users are using the same and unique SSID, according to the settings I have seen on the client device (the users connect to the system using BCRs like Motorola MC9090 running on WinMo 5). And also the AP are configured as heavy access points.

And I have set up AMP so that each client site has a unique group of access points. So supposed to have the same configuration. This group doesn't have template though but is ready to have one someday, like most of other sites/AP groups I handle.

Thanks for your help.

wnelsen on "Various authentification types"

wnelsen — Tue, 09 Jun 2009 19:39:23 +0000

You are correct, snoel-SA, the User Guide could use a little updating on this topic; a project that is currently in progress.

What AMP shows for Auth Type and Cipher depends on what information the server receives from the APs and/or controllers it's monitoring. The client devices might all be similar --in this case, bar code scanners-- but if the APs they are associated with are of different models, or if security is set up differently on them, different Auth Type values may be reported to the AWMS server.

If by "unique group of access points" you mean that all of the APs are the same model and all are set up the same way, then another reason for differing Auth Types might be the use of multiple VLANs or SSIDs. One client device might authenticate on one SSID using one Auth Type and another client device might authenticate on a second SSID using a different Auth Type.

This might also explain what's happening in madransom's case. If a fat AP allows local authentication, it might be possible to bypass a captive portal.

To gain more clarity we'd need to know a little bit more about the individual environments. What kind of APs are deployed? ...fat? thin? vendor? model? Is authentication done on the AP? on a controller? using an external RADIUS server? Have multiple VLANs/ SSIDs been defined?

madransom on "Various authentification types"

madransom — Tue, 09 Jun 2009 16:14:17 +0000

I'm also curious about this. A couple of users have reported that they were able to bypass the captive portal. When looking at the auth type, the one user I'm working with also had "Authenticated by AP". We use 802.1x and a captive portal, but I'm not sure why users with this auth type appear to be able to bypass the captive portal.