Cisco Wireless Intrusion Prevention System Configuration Guide, Release 7.6

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco Wireless Intrusion Prevention System Configuration Guide, Release 7.6

Chapter Title

Adding and Deleting Mobility Services Engines and Licenses

Results

Updated:
December 20, 2013

Chapter: Adding and Deleting Mobility Services Engines and Licenses

Adding and Deleting Mobility Services Engines and Licenses

This chapter describes how to add and delete a Cisco 3300 series Mobility Services Engine to and from the Cisco Prime Infrastructure.


Note

The Mobility Services Engines, Synchronize Services, Synchronization History, High Availability, Context Aware Notifications, and Mobile Concierge pages on the Identity Services tab are available only in the root virtual domain in Release 7.3.101.0.

This chapter contains the following sections:

Licensing Requirements for MSE

The MSE packages together multiple product features related to network topology, design such as Network Mobility Services Protocol (NMSP), and Network Repository along with related service engines and application processes, such as the following:

The following three types of licenses are available:

  • Base Location License—Provides advanced spectrum capability and the ability to detect, track, and trace rogue devices, Cisco CleanAir, interferers, Wi-Fi clients, and RFID tags. The Base Location license allows customers and partners to use standard MSE APIs. For a list of partners, see the Cisco Developer Network Mobility Services API page. The Base Location license also includes the CMX SDK which allows the organizations to integrate Wi-Fi-based indoor navigation with push notification and auto-launch capabilities into mobile applications.
  • CMX License—CMX license is available for Location Analytics service and CMX. You can upgrade from base location license to CMX license by buying the upgrade SKUs. This license applies for all services except wIPS service.
  • Wireless Intrusion Prevention System (wIPS) License—Cisco wIPS provides attack and rogue access point detection and mitigation and has two license options:
    • Monitor Mode license—These are based on the number of full-time monitoring access points deployed in the network.
    • Enhanced Local Mode license—These are based on the number of local mode access points deployed in the network.

Note

From release 7.5 onwards, wIPS service requires a separate MSE. Also from release 7.5, licensing is AP based and not end point based. To accommodate this, new L-LS-Licenses are introduced in Release 7.5.


Note

CAS licenses will be End of Life with standard 6 months of End of Sale support. Till then both CAS and LS licenses will co-exist.

  • From Release 7.6, Cisco MSE 3355 supports up to 2500 access points for Base Location/CMX and 6000 access points for wIPS . The Cisco MSE virtual appliance supports up to 5,000 access points, depending on the server resources.
  • Cisco MSE 3355 supports 25,000 and high end virtual appliance supports 50,000 clients. All licenses are additive.
  • Maximum platform endpoint count is tracked irrespective of AP based licenses installed.

This section contains the following topics:

MSE License Structure Matrix

The following table lists the breakup of the licenses between the high-end, low-end, and evaluation licenses for the MSE, Location services or Context-Aware Service software, and wIPS.

Table 1 MSE License Structure Matrix
 

High End

Low End

Evaluation

MSE Platform

High-end appliance and infrastructure platform.

Low-end appliance and infrastructure platform.

120 days.

Location Service or Context-Aware Service software

3000, 6000, 12,000 access points

1000 access points

120 days, 100 tags and 100 elements.

3000, 6000, 12,000 access points

1000 elements

wIPS

6000 access points

2000 access points

120 days, 20 access points.

Sample MSE License File

The following is a sample MSE license file:

Feature MSE Cisco 1.0 permanent uncounted \

VENDOR_STRING=UDI=udi,COUNT=1 \

HOSTID=ANY \

NOTICE="<LicFileID>MSELicense</LicFileID><LicLineID>0</Li cLineID> \ <PAK>dummyPak</PAK>" \

SIGN="0C04 1EBA BE34 F208 404F 98ED 43EC \

45D7 F881 08F6 7FA5 4DED 43BC AF5C C359 0444 36B2 45CF 6EA6 \

1DB1 899F 413F F543 F426 B055 4C7A D95D 2139 191F 04DE"

This sample file has 5 license entries. The first word of the first line of any license entry tells you what type of license it is. It can either be a Feature or Increment license. A Feature license is a static, lone-item license. An Increment license is an additive license. In the MSE, the individual service engines are treated as Increment licenses.

The second word of the first line defines the specific component to be licensed (for example, MSE). The third word defines the vendor of the license (for example, Cisco). The fourth word defines the version of the license (for example, 1.0). The fifth word defines the expiration date; this can be permanent for licenses that never expire or a date in the format dd-mmm-yyyy. The last word defines whether this license is counted.

Revoking and Reusing an MSE License

You can revoke an MSE appliance license from one system and reuse it on another system. When you revoke a license, the license file is deleted from the system. If you want to reuse the license on another system, then the license needs to be rehosted.

If you want to reuse a license with an upgrade SKU on another system, then you need to have the corresponding base license SKU installed in the system to which you want to reuse the upgrade SKU. You cannot reuse the upgrade license SKU in a system if the corresponding base license SKU is deleted from it.

When you revoke a license, the MSE restarts the individual service engines to reflect the changes to the licenses. Then the service engines receives the updated capacity from MSE during startup.

For more information on licensing, see the Cisco Prime Infrastructure Configuration Guide, Release 1.4.

Guidelines and Limitations

Follow these guidelines when adding an MSE to the Prime Infrastructure and registering device and wIPS product authorization keys:

  • From release 7.5 onwards, wIPS service requires a separate MSE.
  • After adding a new Mobility Services Engine, you can synchronize network designs (campus, building, and outdoor maps), controllers, switches (Catalyst 3000 series and 4000 series only), and event groups for the Mobility Services Engine and the Prime Infrastructure.

    Note

    From Release 7.5 onwards, Cisco Engine for Clients and Tags is used to track tags. If a tag license is detected when you are upgrading from Release 7.2 and later Releases to Release 7.5, then a warning message is displayed about removing the AeroScout license and engine. If you accept, then it removes all the partner engine sub services and Cisco Tag Engine sub service is enabled by default. If you do not accept the removal of partner engine, then it continues with the installation. While upgrading, if no tag licenses are detected, then the installation proceeds as before.

  • If you had changed the username and password during the automatic installation script, enter those values here while adding a Mobility Services Engine to the Prime Infrastructure. If you did not change the default passwords, we recommend that you rerun the automatic installation script and change the username and password.

Adding a Mobility Services Engine to the Prime Infrastructure

You can add MSE using the Add Mobility Services Engine dialog box in the Mobility Service page. In this dialog box, you can add licensing files, tracking parameters, and assign maps to MSE. If you launch the wizard with an existing MSE for configuration, then the Add MSE option appears as Edit MSE Details.


Tip

To learn more about Cisco Adaptive wIPS features and functionality, go to http:/​/​www.cisco.com/​ to watch a multimedia presentation. Here you can find the learning modules for a variety of the Prime Infrastructure topics. Over future releases, there will be more overview and technical presentations to enhance your learning.


Note

The Prime Infrastructure Release 1.0 recognizes and supports MSE 3355 appropriately.


Note

The Services > Mobility Services Engine page is available only in the virtual domain in Release 7.3.101.0.

To add a Mobility Services Engine to the Prime Infrastructure, log in to the Prime Infrastructure and follow these steps:

    Step 1   Verify that you can ping the Mobility Services Engine.
    Step 2   Choose Services > Mobility Services Mobility Services Engines to display the Mobility Services page.
    Step 3   From the Select a command drop-down list, choose Add Mobility Services Engine, and click Go.
    Step 4   In the Device Name text box, enter a name for the Mobility Services Engine.
    Step 5   In the IP Address text box, enter the IP address of the Mobility Services Engine.
    Step 6   (Optional) In the Contact Name text box, enter the name of the Mobility Services Engine administrator.
    Step 7   In the User Name and Password text boxes, enter the username and password for the Mobility Services Engine.

    This refers to the Prime Infrastructure communication username and password created during the setup process.

    If you have not specified the username and password during the setup process, use the defaults.

    The default username and password are both admin.

    Note   

    If you changed the username and password during the automatic installation script, enter those values here. If you did not change the default passwords, we recommend that you rerun the automatic installation script and change the username and password.

    Step 8   Select the HTTPS check box to allow communication between the Mobility Services Engine and third-party applications. By default, the Prime Infrastructure uses HTTPSs to communicate with the MSE.
    Step 9   Select the Delete synchronized service assignments check box if you want to permanently remove all service assignments from the Mobility Services Engine.

    This option is applicable for network designs, wired switches, controllers and event definitions. The existing location history data is retained, however, you must use manual service assignments to perform any future location calculations.

    Step 10   Click Next. The Prime Infrastructure automatically synchronizes the selected elements with the MSE.

    After the synchronization, the MSE License Summary page appears. You can use the MSE License Summary page to install a license, add a license, remove a license, install an activation license, and install service license. The Select Mobility Service page appears.

    Step 11   To enable a service on the Mobility Services Engine, select the check box next to the service. Services include Context-Aware Service and wIPS.

    You can choose CAS to track clients, rogues, interferers, wired clients, and tags.

    Choose Cisco Tag Engine to track tags.

    Step 12   Click Save.
    Note   

    After adding a new Mobility Services Engine, you can synchronize network designs (campus, building, and outdoor maps), controllers, switches (Catalyst Series 3000 only), and event groups on the local Mobility Services Engine using the Prime Infrastructure. You can perform this synchronization immediately after adding a new Mobility Services Engine or at a later time. To synchronize the local and the Prime Infrastructure databases, see Synchronizing Mobility Services Engines.

    Enabling Services on the Mobility Services Engine

    To enable services on the Mobility Services Engine, follow these steps:

      Step 1   After adding the license file, the Select Mobility Service page appears.
      Step 2   To enable a service on the Mobility Services Engine, select the check box next to the service. The different type of services are as follows:
      • Context Aware Service—If you select the Context Aware Service check box, then you must select a location engine to perform location calculation. You can choose CAS to track clients, rogues, interferers, and tags. You can choose Cisco Context-Aware Engine for Clients and Tag to track tags.
      • Wireless Intrusion Prevention System—If you select the Wireless Intrusion Prevention System check box, it detects wireless and performance threats.
      • Mobile Concierge Service—If you select the Mobile Concierge Service check box, it provides service advertisements that describe the available services for the mobile devices.
      • Location Analytics Service—If you select the Location Analytics Service check box, it provides a set of data analytic tools packaged for analyzing Wi-Fi device location data that comes from the MSE.
      Note   

      From release 7.5 onward, wIPS service requires a dedicated MSE because it does not support CAS and wIPS on the same MSE.

      Step 3   Click Next to configure the tracking parameters.
      Step 4   After you enable services on the Mobility Services Engine, the Select Tracking & History Parameters page appears.
      Note   

      If you skip configuring the tracking parameters, the default values are selected.

      Step 5   You can select the clients that you want to keep track of by selecting the corresponding Tracking check box(es). The various tracking parameters are as follows:
      • Wired Clients
      • Wireless Clients
      • Rogue Access Points
        • Exclude Adhoc Rogue APs
      • Rogue Clients
      • Interferers
      • Active RFID Tags
      Step 6   You can enable the history tracking of devices by selecting the corresponding devices check box(es). The different history parameters are as follows:
      • Wired Stations
      • Client Stations
      • Rogue Access Points
      • Rogue Clients
      • Interferers
      • Asset Tags
      Step 7   Click Next to Assign Maps to the MSE.
      Note   

      The Assigning Maps page is available only if you select CAS as one of the services to be enabled on the MSE.

      Step 8   Once you configure MSE tracking and history parameters, the Assigning Maps page appears.

      The Assign Maps page shows the following information:

      • Map Name
      • Type (building, floor, campus)
      • Status
      Step 9   You can see the required map type by selecting All, Campus, Building, Floor Area, or Outdoor Area from the Filter option available in the page.
      Step 10   To synchronize a map, select the Name check box, and click Synchronize.

      Upon synchronization of the network designs, the appropriate controllers that have APs assigned on a particular network design are synchronized with the MSE automatically. Click Done to save the MSE settings.

      Configuring MSE Tracking and History Parameters

        Step 1   After you enable services on the Mobility Services Engine, the Select Tracking & History Parameters page appears.
        Note   

        If you skip configuring the tracking parameters, the default values are selected.

        Step 2   You can select the clients that you want to keep track of by selecting the corresponding Tracking check box(es). The various tracking parameters are as follows:
        • Wired Clients
        • Wireless Clients
        • Rogue Access Points
          • Exclude Adhoc Rogue APs
        • Rogue Clients
        • Interferers
        • Active RFID Tags
        Step 3   You can enable the history tracking of devices by selecting the corresponding devices check box(es). The different history parameters are as follows:
        • Wired Stations
        • Client Stations
        • Rogue Access Points
        • Rogue Clients
        • Interferers
        • Asset Tags
        Step 4   Click Next to Assign Maps to the MSE.

        Assigning Maps to the MSE


        Note

        The Assigning Maps page is available only if you select CAS as one of the services to be enabled on the MSE.

        To assign maps to the MSE, follow these steps:

          Step 1   Once you configure MSE tracking and history parameters, the Assigning Maps page appears.

          The Assign Maps page shows the following information:

          • Map Name
          • Type (building, floor, campus)
          • Status
          Step 2   You can see the required map type by selecting All, Campus, Building, Floor Area, or Outdoor Area from the Filter option available on the page.
          Step 3   To synchronize a map, select the Name check box, and click Synchronize.

          Upon synchronization of the network designs, the appropriate controllers that have APs assigned on a particular network design are synchronized with the MSE automatically. Click Done to save the MSE settings.

          Deleting an MSE License File

          To delete an MSE license file, follow these steps:

            Step 1   Choose Services > Mobility Service Engine.

            The Mobility Services page appears.

            Step 2   Click Device Name to delete a license file for a particular service.Select the Mobility Services Engine(s) to be deleted by selecting the corresponding Device Name check box(es).
            Step 3   From the Select a command drop-down list, choose Edit Configuration.

            The Edit Mobility Services Engine dialog box appears.

            Step 4   Click Next in the Edit Mobility Services Engine dialog box.

            The MSE License Summary page appears.

            Step 5   Choose the MSE license file that you want to delete in the MSE License Summary page.
            Step 6   Click Remove License.
            Step 7   Click OK to confirm the deletion or Cancel to close this page without deleting the license.
            Step 8   Click Next to enable services on the Mobility Services Engine.

            Deleting a Mobility Services Engine from the Prime Infrastructure

            To delete one or more Mobility Services Engines from the Prime Infrastructure database, follow these steps:

              Step 1   Choose Services > Mobility ServicesMobility Services Engines.

              The Mobility Services page appears.

              Step 2   Select the Mobility Services Engine to be deleted by selecting the corresponding Device Name check box(es).
              Step 3   From the Select a command drop-down list, choose Delete Service(s). Click Go.
              Step 4   Click OK to confirm that you want to delete the selected Mobility Services Engine from the Prime Infrastructure database.
              Step 5   Click Cancel to stop deletion.

              Registering Device and wIPS Product Authorization Keys

              You receive a Product Authorization Key (PAK) when you order a CAS element, wIPS, or tag license from Cisco. You must register the PAK to receive the license file for installation on the Mobility Services Engine. License files are e-mailed to you after successfully registering a PAK. Client and wIPS PAKs are registered with Cisco.

              To register a PAK to obtain a license file for installation, follow these steps:

                Step 1   On your web browser, go to http:/​/​tools.cisco.com/​SWIFT/​LicensingUI/​Home.
                Step 2   Enter the PAK, and click SUBMIT.
                Step 3   Verify the license purchase. Click Continue if correct . The licensee entry page appears.
                Note   

                If the license is incorrect, click the TAC Service Request Tool URL to report the problem.

                Step 4   In the Designate Licensee page, enter the UDI of the Mobility Services Engine in the Host Id text box. This is the Mobility Services Engine on which the license is installed.
                Note   

                UDI information for a Mobility Services Engine is found in the General Properties at Services > Mobility Services Engine > Device Name > System.

                Step 5   Select the Agreement check box. Registrant information appears beneath the Agreement check box.
                Step 6   If the registrant and end user are not the same person, select the Licensee (End-User) check box beneath registrant information and enter the information for the end user.
                Step 7   Click Continue. A summary of entered data appears.
                Step 8   In the Finish and Submit page, review registrant and end-user data. Click Edit Details to correct any information. Click Submit. A confirmation page appears.

                Installing Device and wIPS License Files

                You can install device and wIPS licenses from the Prime Infrastructure. From Release 7.5 onwards, Cisco Engine for Clients and Tags is used to track tags. If a tag license is detected when you are upgrading from Release 7.2 and later releases to Release 7.5, then a warning message is displayed about removing the AeroScout license and engine. If you accept, then it removes all the partner engine sub services and Cisco Tag Engine sub service is enabled by default. If you do not accept to remove the partner engine, then it will continue with the installation. If there are no tag licenses are detected, then the installation will proceed as before.

                The Administration > License Center page is available only in the virtual domain in Release 7.3.101.0 and later.

                To add a device or wIPS license to the Prime Infrastructure after registering the PAK, follow these steps:

                  Step 1   Choose Administration > License CenterLicenses.
                  Step 2   Choose Files > MSE Files from the left sidebar menu.
                  Step 3   Click Add. The Add a License File dialog box appears.


                  Step 4   Choose the applicable MSE name from the MSE Name drop-down list.
                  Note   

                  Verify that the UDI of the selected Mobility Services Engine matches the one that you entered when registering the PAK.

                  Step 5   Click Choose FileBrowse to select the license file.
                  Step 6   Click UploadOk. The newly added license appears in the MSE license file list.

                  Was this Document Helpful?

                  FeedbackFeedback

                  Contact Cisco