Creating Controller Configuration Groups
This chapter describes how to create controller configuration groups and mobility groups.
Adding Controller Configuration Groups
To add new controller configuration groups, follow these steps:
Step 1
Choose Configuration > Templates > Controller Configuration Groups.
Step 2
From the Select a command drop-down list, choose Add Configuration Group, and click Go. The Add New Group page appears.
Step 3
Enter the new configuration group name. It must be unique across all groups.
Step 4
Other templates created in Prime Infrastructure can be assigned to a configuration group. The same WLAN template can be assigned to more than one configuration group. Choose from the following:
- Click Select and add later to add a template at a later time.
- Click Copy templates from a controlle r to copy templates from another controller. Choose a controller from a list of current controllers to copy its applied template to the new configuration group. Only the templates are copied.
The order of the templates is important when dealing with radio templates. For example, if the template list includes radio templates that require the radio network to be disabled prior to applying the radio parameters, the template to disable the radio network must be added to the template first.
Step 5
Click Save. The Configuration Groups page appears.
Related Topics
Configuring Controller Configuration Groups
To configure a controller configuration group, follow these steps:
Step 1
Choose Configuration > Templates > Controller Configuration Groups, and click a group name in the Group Name column. The Configuration Group page appears.
Step 2
Click the General tab. The following options for the configuration group appear:
- Group Name: Name of the configuration group
–
Enable Background Audit—If selected, all the templates that are part of this group are audited against the controller during network and controller audits.
–
Enable Enforcement—If selected, the templates are automatically applied during the audit if any discrepancies are found.
The audit and enforcement of the configuration group template happens when the selected audit mode is Template based audit.
–
Enable Mobility Group—If selected, the mobility group name is pushed to all controllers in the group.
- Mobility Group Name: Mobility Group Name that is pushed to all controllers in the group. The Mobility Group Name can also be modified here. A controller can be part of multiple configuration groups.
- Last Modified On: Date and time configuration group was last modified.
- Last Applied On: Date and time last changes were applied.
Step 3
You must click the Apply/Schedule tab to distribute the specified mobility group name to the group controllers and to create mobility group members on each of the group controllers.
Step 4
Click Save.
Related Topics
Adding or Removing Controllers from a Configuration Group
To add or remove controllers from a configuration group, follow these steps:
Step 1
Choose Configuration > Templates > Controller Configuration Groups, and click a group name in the Group Name column.
Step 2
Click the Controllers tab. The columns in the table display the IP address of the controller, the configuration group name the controller belongs to, and the mobility group name of the controller.
Step 3
Click to highlight the row of the controller you want to add to the group.
Step 4
Click Add.
If you want to remove a controller from the group, highlight the controller in the Group Controllers box and click Remove.
Step 5
You must click the Apply/Schedule tab, and click Apply to add or remove the controllers to the configuration groups.
Step 6
Click Save Selection.
Related Topics
Adding or Removing Templates from the Configuration Group
To add or remove templates from the configuration group, follow these steps:
Step 1
Choose Configuration > Templates > Controller Configuration Groups, and click a group name in the Group Name column.
Step 2
Click the Templates tab. The Remaining Templates table displays the item number of all available templates, the template name, and the type and use of the template.
Step 3
Click to highlight the row of the template you want to add to the group.
Step 4
Click Add to move the highlighted template to the Group Templates column.
If you want to remove a template from the group, highlight the template in the Remaining Templates box, and click Remove.
Step 5
You must click the Apply/Schedule tab, and click Apply to add or remove the templates to the configuration groups.
Step 6
Click Save Selection.
Related topics
Applying or Scheduling Configuration Groups
The scheduling function allows you to schedule a start day and time for provisioning.
Make sure that any other configuration group functions are not performed during the apply provisioning.
To apply the mobility groups, mobility members, and templates to all the controllers in a configuration group, follow these steps:
Step 1
Choose Configuration > Templates > Controller Configuration Groups, and click a group name in the Group Name column.
Step 2
Click the Apply/Schedule tab to access this page.
Step 3
Click Apply to start the provisioning of mobility groups, mobility members, and templates to all the controllers in the configuration group. After you apply, you can leave this page or log out of Prime Infrastructure. The process continues, and you can return later to this page to view a report.
A report is generated and appears in the Recent Apply Report page. It shows which mobility group, mobility member, or template were successfully applied to each of the controllers.
If you want to print the report as shown on the page, you must choose landscape page orientation.
Step 4
Enter a starting date in the text box or use the calendar icon to choose a start date.
Step 5
Choose the starting time using the hours and minutes drop-down lists.
Step 6
Click Schedule to start the provisioning at the scheduled time.
Related topics
Auditing Configuration Groups
The Configuration Groups Audit page allows you to verify if the configuration of the controller complies with the group templates and mobility group.
When auditing the Configuration Groups:
1.
You can leave this screen or log out of Prime Infrastructure. The process continues, and you can return to this page later to view a report.
2.
Do not perform any other configuration group functions during the audit verification.
3.
This audit does not enforce the Prime Infrastructure configuration to the device. It only identifies the discrepancies
To perform a configuration group audit, follow these steps:
Step 1
Choose Configuration > Templates > Controller Configuration Groups, and click a group name in the Group Name column.
Step 2
Click the Audit tab to access this page.
Step 3
Click to highlight a controller from the Controllers tab, choose >> (Add), and Save Selection.
Step 4
Click to highlight a template from the Templates tab, choose >> (Add), and Save Selection.
Step 5
Click Audit to begin the auditing process.
A report is generated and the current configuration on each controller is compared with that in the configuration group templates. The report displays the audit status, the number of templates in sync, and the number of templates out of sync.
Step 6
Click Details to view the Controller Audit Report details.
Step 7
Double-click a line item to open the Attribute Differences page. This page displays the attribute, its value in Prime Infrastructure, and its value in the controller.
Step 8
Click Retain Prime Infrastructure Value to push all attributes in the Attribute Differences page to the device.
Step 9
Click Close to return to the Controller Audit Report page.
Related topics
Rebooting Configuration Groups
To reboot a configuration group, follow these steps:
Step 1
Choose Configuration > Templates > Controller Configuration Groups, and click a group name in the Group Name column.
Step 2
Click the Reboot tab.
Step 3
Check the Cascade Reboot check box if you want to reboot one controller at a time, waiting for that controller to come up before rebooting the next controller.
Step 4
Click Reboot to reboot all controllers in the configuration group at the same time. During the reboot, you can leave this page or logout of Prime Infrastructure. The process continues, and you can return later to this page and view a report.
The Recent Reboot Report page shows when each controller was rebooted and what the controller status is after the reboot. If Prime Infrastructure is unable to reboot the controller, a failure is shown.
If you want to print the report as shown on the page, you must choose landscape page orientation.
Related topics
Viewing Configuration Group Reports
To display all recently applied reports under a specified group name, follow these steps:
Step 1
Choose Configuration > Templates > Controller Configuration Groups, and click a group name in the Group Name column.
Step 2
Click the Report tab. The Recent Apply Report page displays all recently applied reports including the apply status, the date and time the apply was initiated, and the number of templates. The following information is provided for each individual IP address:
- Apply Status—Indicates success, partial success, failure, or not initiated.
- Successful Templates—Indicates the number of successful templates associated with the applicable IP address.
- Failures—Indicates the number of failures with the provisioning of mobility group, mobility members, and templates to the applicable controller.
- Details—Click Details to view the individual failures and associated error messages.
Step 3
If you want to view the scheduled task reports, click the click here link at the bottom of the page. You are then redirected to the Configure > Scheduled Configuration Tasks > Configuration Group menu where you can view reports of the scheduled configuration groups.
Related Topics
Downloading Software to Configuration Groups
To download software to all controllers in the selected groups after you have established a configuration group, follow these steps:
Step 1
Choose Configuration > Templates > Controller Configuration Groups.
Step 2
Select the check box to choose one or more configuration groups names on the Configuration Groups page.
Step 3
Choose Download Software from the Select a command drop-down list, and click Go.
Step 4
The Download Software to Controller page appears. The IP address of the controller to receive the bundle and the current status are displayed. Choose local machine from the File is Located On field.
Step 5
Enter the maximum number of times the controller should attempt to download the signature file in the Maximum Retries field.
Step 6
Enter the maximum amount of time in seconds before the controller times out while attempting to download the signature file in the Timeout field.
Step 7
The signature files are uploaded to the c:\tftp directory. Specify the local filename in that directory or click Browse to navigate to it. The controller uses this local filename as a base name and then adds _custom.sgi as a suffix.
If the transfer times out for some reason, you can simply choose the TFTP server option in the File Is Located On field, and the server filename is populated for you and retried.
Step 8
Click OK.
Related topics
Downloading IDS Signatures to Configuration Groups
To download Intrusion Detection System (IDS) signature files from your configuration group to a local TFTP server, follow these steps:
Step 1
Choose Configuration > Templates > Controller Configuration Groups.
Step 2
Select the check box to choose one or more configuration groups on the Configuration Groups page.
Step 3
Choose Download IDS Signatures from the Select a command drop-down list, and click Go.
Step 4
The Download IDS Signatures to Controller page appears. The IP address of the controller to receive the bundle and the current status are displayed. Choose local machine from the File is Located On field.
Step 5
Enter the maximum number of times the controller should attempt to download the signature file in the Maximum Retries field.
Step 6
Enter the maximum amount of time in seconds before the controller times out while attempting to download the signature file in the Timeout field.
Step 7
The signature files are uploaded to the c:\tftp directory. Specify the local filename in that directory or click Browse to navigate to it. The controller uses this local filename as a base name and then adds _custom.sgi as a suffix.
If the transfer times out for some reason, you can simply choose the TFTP server option in the File Is Located On field, and the server filename is populated for you and retried.
Step 8
Click OK.
Related topics
Downloading Customized WebAuth to Configuration Groups
To download customized web authentication, follow these steps:
Step 1
Choose Configuration > Templates > Controller Configuration Groups.
Step 2
Select the check box to choose one or more configuration groups on the Configuration Groups page.
Step 3
Choose Download Customized WebAuth from the Select a command drop-down list, and click Go.
Step 4
The Download Customized Web Auth Bundle to Controller page appears. The IP address of the controller to receive the bundle and the current status are displayed.
Step 5
Choose local machine from the File is Located On field.
Related topics
About Mobility
Mobility, or roaming, is an ability of a wireless client to maintain its association seamlessly from one access point to another, securely and with as little latency as possible, in a wireless network. When a wireless client is associated to and authenticated by an access point, a controller places an entry for that client in its client database. This entry includes the MAC and IP addresses of the client, security context and associations, quality of service (QoS) contexts, the WLANs, and the associated access point. The controller uses this information to forward frames and manage traffic to and from the wireless client.
Related Topics
Intra-Controller Roaming
When the wireless client moves its association from one access point to another, the controller simply updates the client database with the newly associated access point. If necessary, new security context and associations are established as well. Figure 23-1 illustrates a wireless client roaming from one access point to another when both access points are connected to the same controller.
Figure 23-1 Intra-Controller Roaming
Related Topics
Inter-Controller Roaming
When a client roams from an access point connected to one controller to an access point connected to a different controller, the process also varies based on whether the controllers are operating on the same subnet. Figure 23-2 illustrates inter-controller roaming, which occurs when the wireless LAN interfaces of a controller are on the same IP subnet.
When the client is associated to an access point connected to a new controller, the new controller exchanges mobility messages with the original controller, and the client database entry is moved to the new controller. New security context and associations are established if necessary, and the client database entry is updated for the new access point. This process remains invisible to the user.
All clients configured with 802.1X/Wi-Fi Protected Access (WPA) security complete a full authentication to comply with the IEEE standard.
Figure 23-2 Inter-Controller Roaming
Related topics
Inter-Subnet Roaming
Inter-subnet roaming is similar to inter-controller roaming in that the controllers exchange mobility messages on how the client roams. However, instead of moving the client database entry to the new controller, the original controller marks the client with an “Anchor” entry in its own client database. The database entry is copied to the new controller client database and marked with a “Foreign” entry in the new controller. The roam remains invisible to the wireless client, and the client maintains its original IP address.
After an inter-subnet roam, data flows in an asymmetric traffic path to and from the wireless client. Traffic from the client to the network is forwarded directly into the network by the foreign controller. Traffic to the client arrives at the anchor controller, which forwards the traffic to the foreign controller in an EtherIP tunnel. The foreign controller then forwards the data to the client. If a wireless client roams to a new foreign controller, the client database entry is moved from the original foreign controller to the new foreign controller, but the original anchor controller is always maintained. If the client moves back to the original controller, it becomes local again.
In inter-subnet roaming, WLANs on both anchor and foreign controllers need to have the same network access privileges and no source-based routing or source-based firewalls in place. Otherwise, the clients might have network connectivity problems after the handoff.
Inter-subnet roaming does not support multicast traffic such as one used by Spectralink phones while using push-to-talk.
Figure 23-3 illustrates inter-subnet roaming, which occurs when the wireless LAN interfaces of a controller are on different IP subnets.
Figure 23-3 Inter-Subnet Roaming
Related topics
Symmetric Tunneling
With symmetric mobility tunneling, the controller provides inter-subnet mobility for clients roaming from one access point to another within a wireless LAN. The client traffic on the wired network is directly routed by the foreign controller. If a router has Reverse Path Filtering (RPF) enabled (which provides additional checks on incoming packets), the communication is blocked. Symmetric mobility tunneling allows the client traffic to reach the controller designated as the anchor, even with RPF enabled. All controllers in a mobility group should have the same symmetric tunneling mode.
With this feature, the time it takes for a client to join another access point following a controller failure is decreased because a failure is quickly identified, the clients are moved away from the problem controller, and the clients are anchored to another controller.
About Mobility Groups
A set of controllers can be configured as a mobility group to allow seamless client roaming within a group of controllers. This enables multiple controllers to dynamically share information and forward data traffic when inter-controller or inter-subnet roaming occurs. Controllers can share the context and state of clients and controller loading information With this information, the network can support inter-controller wireless LAN roaming and controller redundancy. Clients do not roam across mobility groups
Figure 23-4 shows an example of a mobility group.
Figure 23-4 A Single Mobility Group
As shown in Figure 23-4, each controller is configured with a list of the other members of the mobility group. Whenever a new client joins a controller, the controller sends out a unicast message to all of the controllers in the mobility group. The controller to which the client was previously connected passes on the status of the client. All mobility exchange traffic between controllers is carried over a CAPWAP tunnel.
Examples:
1.
A 4404-100 controller supports up to 100 access points. Therefore, a mobility group consisting of 24 4404-100 controllers supports up to 2400 access points (24 * 100 = 2400 access points).
2.
A 4402-25 controller supports up to 25 access points, and a 4402-50 controller supports up to 50 access points. Therefore, a mobility group consisting of 12 4402-25 controllers and 12 4402-50 controllers supports up to 900 access points (12 * 25 + 12 * 50 = 300 + 600 = 900 access points).
Mobility groups enable you to limit roaming between different floors, buildings, or campuses in the same enterprise by assigning different mobility group names to different controllers within the same wireless network. Figure 23-5 shows the results of creating distinct mobility group names for two groups of controllers.
Figure 23-5 Two Mobility Groups
The controllers in the ABC mobility group recognize and communicate with each other through their access points and through their shared subnets. The controllers in the ABC mobility group do not recognize or communicate with the XYZ controllers, which are in a different mobility group. Likewise, the controllers in the XYZ mobility group do not recognize or communicate with the controllers in the ABC mobility group. This feature ensures mobility group isolation across the network. Clients might roam between access points in different mobility groups, provided they can detect them. However, their session information is not carried between controllers in different mobility groups.
Related Topics
When to Include Controllers in a Mobility Group
If it is possible for a wireless client in your network to roam from an access point joined to one controller to an access point joined to another controller, both controllers should be in the same mobility group.
Related Topics
Messaging Among Mobility Groups
The controller provides inter-subnet mobility for clients by sending mobility messages to other member controllers. There can be up to 72 members in the list with up to 24 in the same mobility group. In Prime Infrastructure and controller software releases 5.0, two improvements have been made to mobility messaging, each of which is especially useful when sending messages to the full list of mobility members:
- Sending Mobile Announce messages within the same group first and then to other groups in the list
The controller sends a Mobile Announce message to members in the mobility list each time a new client associates to it. In the software releases prior to 5.0, the controller sends this message to all members in the list irrespective of the group to which they belong. However, in the software release 5.0, the controller sends the message only to those members that are in the same group as the controller and then includes all of the other members while sending retries.
- Sending Mobile Announce messages using multicast instead of unicast
In Prime Infrastructure and controller software releases prior to 5.0, the controller might be configured to use multicast to send the mobile announce messages, which requires sending a copy of the messages to every mobility member. This behavior is not efficient because many messages (such as Mobile Announce, Pairwise Master Key (PMK) Update, AP List Update, and Intrusion Detection System (IDS) Shun) are meant for all members in the group. In Prime Infrastructure and controller software releases 5.0, the controller uses multicast mode to send the Mobile Announce messages. This behavior allows the controller to send only one copy of the message to the network, which destines it to the multicast group containing all the mobility members. To derive the maximum benefit from multicast messaging, We recommend that it be enabled or disabled on all group members.
Related Topics
Configuring Mobility Groups: Workflow
Whenever you configure a Mobility Group, follow this workflow:
1.
Make sure you have gathered the information you need and that the participating controller are properly configured, as explained in “Before You Begin Configuring Mobility Groups”.
2.
Add individual controllers to the Mobility Group. You may need to add them manually if no Mobility Groups exist or no controllers are listed when you try to add them from the Configuration> Network > Network Devices page.
3.
Set the scale and messaging parameters for the Mobility Group.
Related Topics
Before You Begin Configuring Mobility Groups
Before you add controllers to a mobility group, you must verify that the following requirements have been met for all controllers that are to be included in the group:
- All controllers must be configured for the same LWAPP transport mode (Layer 2 or Layer 3). Verify and change the LWAPP transport mode by navigating to Administration > Settings > System Settings > General page.
- Verify IP connectivity by pinging the controllers and make sure IP connectivity exists between the management interfaces of all devices.
- All controllers must be configured with the same mobility group name for seamless routing among the access points.
- All devices must be configured with the same virtual interface IP address, else client loses connectivity for a period of time, though inter-controller roaming appears to be working.
- You must have gathered the MAC address and IP address of every controller that is to be included in the mobility group. This information is necessary because you configure all controllers with the MAC address and IP address of all the other mobility group members.
Related Topics
Adding Controllers to Mobility Groups
Step 1
Choose Configuration > Network > Network Devices, then from the Device Groups menu on the left, select Device Type > Wireless Controller.
Step 2
Click on a Device Name for a controller. This allows you to access the controller templates interface for the controller you are managing.
Step 3
Choose System > Mobility Groups from the left sidebar menu. The existing Mobility Group members are listed in the page.
Step 4
You see a list of available controllers. From the Select a command drop-down list in the upper right-hand corner, choose Add Group Members and then click Go.
Step 5
Enter the multicast group IP address to be used for multicast mobility messages in the Multicast Address text box. The group address of the local mobility member must be the same as the group address of the local controller.
Step 6
In the Group Name text box, enter the name of the mobility group.
Step 7
Click Save.
Step 8
Repeat steps 1 through 8 for the remaining controllers.
Related Topics
Adding Controllers to Mobility Groups Manually
You can add controllers to Mobility Groups manually if you cannot display a list of existing Mobility Groups and available controller.
Step 1
Choose Configuration > Network > Network Devices, then from the Device Groups menu on the left, select Device Type > Wireless Controller.
Step 2
Click on a Device Name for a controller. This allows you to access the controller templates interface for the controller you are managing.
Step 3
The Wireless Controller page appears. Click Configuration tab.
Step 4
Choose System > Mobility Groups from the left sidebar menu. The existing Mobility Group members are listed in the page.
Step 5
You see a list of available controllers. From the Select a command drop-down list in the upper right-hand corner, choose Add Group Members and then click Go.
Step 6
If you don't see a list of controllers, click the “To add members manually to the Mobility Group click here” link. The Mobility Group Member page appears.
Step 7
In the Member MAC Address text box, enter the MAC address of the controller to be added.
Step 8
In the Member IP Address text box, enter the management interface IP address of the controller to be added.
If you are configuring the mobility group in a network where Network Address Translation (NAT) is enabled, enter the IP address sent to the controller from the NAT device rather than the management interface IP address of the controller. Otherwise, mobility fails among controllers in the mobility group.
Step 9
Enter the multicast group IP address to be used for multicast mobility messages in the Multicast Address text box. The group address of the local mobility member must be the same as the group address of the local controller.
Step 10
In the Group Name text box, enter the name of the mobility group.
Step 11
Click Save.
Step 12
Repeat steps 1 through 12 for the remaining controllers.
Related Topics
Setting Mobility Scalability Parameters
Complete the procedure of Adding Controllers To Mobility Groups before setting the mobility message parameters.
Step 1
Choose Configuration > Network > Network Devices, then from the Device Groups menu on the left, select Device Type > Wireless Controller.
Step 2
Click on a Device Name for a controller whose software version is 5.0 or later.
Step 3
The Wireless Controller page appears. Click Configuration tab.
Step 4
Choose System > Multicast from the left sidebar menu. The Multicast page appears.
Step 5
Choose Multicast or Unicast from the Ethernet Multicast Support drop-down list.
Step 6
Enter the group IP address at the Multicast Group Address field, if you chose multicast in Step 4, to begin multicast mobility messaging. You must also configure this IP address for the local mobility group, but it is optional for other groups within the mobility list. If you do not configure the IP address for other (non-local) groups, the controllers use unicast mode to send mobility messages to those members.
Step 7
Select the Global Multicast Mode check box to make the multicast mode available globally.
Step 8
Choose Enable from the Multicast Mobility Mode drop-down list, and enter the mobility group multicast address.
Step 9
Select the Multicast Direct check box to enable videos to be streamed over a wireless network.
Step 10
Specify the Session Banner information, which is the error information sent to the client if the client is denied or dropped from a Media Stream. All media streams on a controller share this configuration.
a.
State—Select the check box to activate the Session Banner. If not activated, the Session Banner is not sent to the client
b.
URL—A web address reported to the client
c.
Email—An e-mail address reported to the client
d.
Phone—A telephone number reported to the client
e.
Note—A note reported to the client
Step 11
Click Save.
Related Topics
Mobility Anchors
Mobility anchors are a subset of a mobility group specified as the anchor controllers for a WLAN. This feature can be used to restrict a WLAN to a single subnet, regardless of the entry point of a client into the network. In this way, users can access a public or guest WLAN throughout an enterprise but still be restricted to a specific subnet. Guest WLAN can also be used to provide geographic load balancing because WLANs can represent a particular section of a building (such as a lobby, a restaurant, and so on).
Related Topic
Adding Multiple Controllers And Setting DCA Channels
Step 1
Choose Configuration > Templates > Controller Configuration Groups.
Step 2
Choose Add Configuration Groups from the Select a command drop-down list, and click Go.
Step 3
Create a configuration group by entering the group name and mobility group name.
Step 4
Click Save. The Configuration Groups page appears.
Step 5
Click the Controllers tab. The Controllers page appears.
Step 6
Highlight the controllers you want to add, and click Add. The controller is added to the Group Controllers page.
Step 7
Click the Country/DCA tab. The Country/DCA page appears. Dynamic Channel Allocation (DCA) automatically selects a reasonably good channel allocation amongst a set of managed devices connected to the controller.
Step 8
Check the Update Country/DCA check box to display a list of countries from which to choose.
Step 9
Those DCA channels that are currently configured on the controller for the same mobility group are displayed in the Select Country Codes page. The corresponding 802.11a/n and 802.11b/n allowable channels for the chosen country is displayed as well. You can add or delete any channels in the list by selecting or deselecting the channel and clicking Save Selection.
Configuring Controller Mobility Groups: Workflow
By creating a configuration group, you can group controllers that should have the same mobility group name and similar configuration. You can assign templates to the group and push templates to all the controllers in a group. You can add, delete, or remove configuration groups, and download software, IDS signatures, or a customized web authentication page to controllers in the selected configuration groups. You can also save the current configuration to nonvolatile (flash) memory to controllers in selected configuration groups.
Before You Begin
- Bear in mind that a controller cannot be a member of more than one mobility group. Adding a controller to one mobility group removes that controller from any other mobility group to which it is already a member.
- By choosing Configuration > Templates > Controller Configuration Groups, you can view a summary of all configuration groups in the Prime Infrastructure database. When you choose Add Configuration Groups from the Select a command drop-down list, the page displays a table with the following columns:
–
Group Name: Name of the configuration group.
–
Templates: Number of templates applied to configuration group.
Related topics