排除Umbrella无线控制器(9800)集成故障

下载选项

PDF (509.8 KB)
在各种设备上使用 Adobe Reader 查看

已更新: 2025 年 9 月 30 日

文档 ID:225099

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

简介

本文档介绍如何对9800系列无线控制器与Umbrella的集成进行故障排除。

概述

本文是Cisco Catalyst 9200和Catalyst 9300交换机的延续，可作为对9800和Cisco Umbrella之间的注册问题和工作流程进行故障排除的指南。

Cisco Umbrella常规工作流程

4415377983508

向Cisco Umbrella服务器注册无线控制器是一个一次性过程，通过安全的HTTPS隧道进行。
从Cisco Umbrella控制面板获取设备(9800)注册的API令牌。
在9800上应用令牌。这会将设备注册到Cisco Umbrella帐户。接下来，在9800上创建Cisco Umbrella Profile。配置文件会自动推送到Cisco Umbrella，因为身份和策略是基于每个身份实施的。
无线客户端流量流向Cisco Umbrella服务器。
无线客户端向9800发送DNS请求。
9800监听DNS数据包，并使用思科Umbrella配置文件对其进行标记。配置文件是也驻留在Cisco Umbrella上的数据包的身份。
此EDNS数据包重定向到Cisco Umbrella云服务器进行名称解析。
然后，Cisco Umbrella根据身份实施策略，并应用基于类别的过滤规则以确保组织合规。
根据规则，它会将阻止的页面或已解析的IP地址返回给查询的DNS请求的客户端。

有关配置9800的详细步骤，请参阅安全配置指南。

注册和证书导入

从Umbrella控制面板获取您的API令牌：Admin > API Keys >（创建）Legacy Network Devices。
使用以下任一方法，通过CLI将CA证书导入9800:
从URL导入
发出命令并允许9800获取证书：
```
crypto pki trustpool import url http://www.cisco.com/security/pki/trs/ios.p7b
```
直接导入终端
使用命令复制并粘贴CA证书（请参阅附件）：
```
crypto pki trustpool import terminal
```

使用命令将API令牌输入到9800 CLI:

parameter-map type umbrella global 
token XXXXXXXXXXXXXXXXXXXXXXXXXXXX

验证Cisco Umbrella配置

要查看Cisco Umbrella配置详细信息，请使用此命令：

Device# show umbrella config

Umbrella Configuration
========================
Token: 5XXXXXXABXXXXXFXXXXXXXXXDXXXXXXXXXXXABXX
API-KEY: NONE
OrganizationID: xxxxxxx
Local Domain Regex parameter-map name: dns_bypass
DNSCrypt:Enabled 
Public-key: B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79
UDP Timeout: 5 seconds
Resolver address:
1. 208.67.220.220 
2. 208.67.222.222 
3. 2620:119:53::53 
4. 2620:119:35::35

ewc1#show umbrella deviceid detailed 

Device registration details 
1.global
     Tag : global 
     Device-id : 010a2ed75e520fda 
     Description : Device Id recieved successfully 
     WAN interface : None

ewc1#show umbrella dnscrypt
   DNSCrypt: Enabled
   Public-key: B735:1140:206F:225D:3E2B:D822:D7FD:691E:A1C3:3CC8:D666:8D0C:BE04:BFAB:CA43:FB79
   Certificate Update Status:
        Last Successfull Attempt: 10:40:58 UTC Apr 8 2020
   Certificate Details:
       Certificate Magic     : DNSC
       Major Version         : 0x0001
       Minor Version         : 0x0000
       Query Magic           : 0x7163373861576F6F
       Serial Number         : 1574811744
       Start  Time           : 1574811744 (23:42:24 UTC Nov 26 2019)
       End Time              : 1606347744 (23:42:24 UTC Nov 25 2020)
       Server Public Key     : 88B4:E44B:35E9:64B4:90BD:DABA:E825:A24B:0415:A08B:E19D:7DDB:87A3:3CD7:7EDF:8E2F

       Client Secret Key Hash: E323:7E82:C0C2:1F0C:55AE:1473:862D:6D26:9607:B41D:3F51:F587:9482:8709:401E:2EC4
       Client Public key     : 8D52:4D73:CF69:4890:F130:2845:4CBE:A9CA:87AF:4CDA:FE17:C626:2F8A:1780:CD18:C855

       NM key Hash           : FAAD:4C16:6DA3:D6F3:655D:FF98:36B7:73E7:9D1C:21F5:A0E3:A083:17D7:C308:522E:722D

调试和日志记录

要禁用DNSCrypt，请使用此命令：

parameter-map type umbrella global > no dnscrypt

您可能会看到以下错误："无法使用URL导入证书":

crypto pki trustpool import urlhttp://www.cisco.com/security/pki/trs/ios.p7b

% Error: failed to open file.

% No certificates imported fromhttp://www.cisco.com/security/pki/trs/ios.p7b.

解决方法：

从此位置手动复制和粘贴PEM格式的CA证书。

接下来，启用设备注册调试日志：

debug umbrella dnscrypt
debug umbrella device-registration
debug umbrella config
term monitor

注意：可能会出现多个9800可以分配相同设备ID的实例。对于虚拟9800（嵌入式无线控制器[WC]），会出现这种情况。

所有虚拟WC都具有相同的硬编码MAC地址：“CC46D6CCCCCC”。

从eWC A调试示例：

Nov 2 19:21:18.903 Central: UMBRELLA-DEV-REG:Device registration process start: umbrella parameter-map global (tag: global): TCP socket created, connect state will be verified before sending out request
Nov 2 19:21:18.915 Central: UMBRELLA-DEV-REG:Socket 0 event handler: event type = WRITE EVENT
Nov 2 19:21:18.915 Central: UMBRELLA-DEV-REG:Send POST request invoked
Nov 2 19:21:18.915 Central: UMBRELLA-DEV-REG:Get registration request info invoked
Nov 2 19:21:18.915 Central: UMBRELLA-DEV-REG:Get registration request info: Found new queued request for umbrella parameter-map global (tag: global), status :REQ QUEUED 
Nov 2 19:21:18.915 Central: UMBRELLA-DEV-REG:Send POST request for umbrella parameter-map global (tag: global): status = 1
Nov 2 19:21:18.915 Central: UMBRELLA-DEV-REG:Send POST request for umbrella parameter-map global (tag: global): request license mode = TOKEN
Nov 2 19:21:18.915 Central: UMBRELLA-DEV-REG:Send POST request for umbrella parameter-map global (tag: global): POST size = 238, JSON size = 174,actual size = 412 , uri_size = 18
Nov 2 19:21:18.915 Central: UMBRELLA-DEV-REG:
Nov 2 19:21:18.915 Central: Dev reg json buffer :{"model":"B77A8731C7F4D6E92C07D7DCB68961470000A553","macAddress":"CC46D6CCCCCC","label":"global","tag":"global","serialNumber":"9KZNYR9FRRQ"} and bytes: 141
Nov 2 19:21:18.915 Central: UMBRELLA-DEV-REG:
Nov 2 19:21:18.915 Central: umbrella parameter-map name :global macAddr :cc46.d6cc.cccc 
Nov 2 19:21:18.915 Central: UMBRELLA-DEV-REG:Build POST request invoked: post size = 238, size = 141
Nov 2 19:21:18.915 Central: UMBRELLA-DEV-REG:Build POST request: hostname = api.opendns.com
Nov 2 19:21:18.915 Central: UMBRELLA-DEV-REG:Build POST request: URI = /v3/networkdevices
Nov 2 19:21:18.916 Central: UMBRELLA-DEV-REG:Build POST request done
Nov 2 19:21:18.916 Central: UMBRELLA-DEV-REG:Send POST request for umbrella parameter-map global (tag: global): request buffer length = 368
Nov 2 19:21:18.916 Central: UMBRELLA-DEV-REG:Send POST request for umbrella parameter-map global (tag: global): Built request = POST /v3/networkdevices HTTP/1.1
Host: api.opendns.com
Authorization:OpenDNS,api_key="B0E16D19C32D42EC996B635X4X9005B9",token="B77A8731C7F4D6E92C07D7DCB68961470000A553"
Content-Type: application/json
Content-Length: 141

{"model":"B77A7561C7F4ABC92C07D7DCB68961470000A553","macAddress":"CC46D6CCCCCC","label":"global","tag":"global","serialNumber":"9KZNYR9FRRQ"}
----------------------------------------<OUTPUT OMITTED>----------------------------------------
Nov 2 19:21:23.553 Central: UMBRELLA-DEV-REG:Registration response: msg_part = 3, bytes = 256, resp: content-type: application/json
x-envoy-upstream-service-time: 1462
x-xss-protection: 1; mode=block
x-ingress-point: mil1

{"deviceId":"010a7859d0d39393","deviceKey":"B77A8731C7F4D6E92C07D7DCB68961470000A553-CC46D6CCCCCC-global","label":"global","seria
Nov 2 19:21:23.553 Central: UMBRELLA-DEV-REG:Registration response: msg_part = 4, bytes = 1
78, resp: lNumber":"9KZNYR9FPPQ","phishing":1,"createdAt":1635877282,"originId":xxxxxxxx,"
apiKey":"b0e16d19c32d42ec996b635x4x9005b9","deviceTypeId":1,"vendorId":51,"organizationId":xxxxx}

从eWC B调试示例：

Nov 2 19:21:41.909 Central: UMBRELLA-DEV-REG:Device registration process start: umbrella parameter-map global (tag: global): TCP socket created, connect state will be verified before sending out request
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Socket 0 event handler: event type = WRITE EVENT
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Send POST request invoked
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Get registration request info invoked
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Get registration request info: Found new queued request for umbrella parameter-map global (tag: global), status :REQ QUEUED 
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Send POST request for umbrella parameter-map global (tag: global): status = 1
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Send POST request for umbrella parameter-map global (tag: global): request license mode = TOKEN
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Send POST request for umbrella parameter-map global (tag: global): POST size = 238, JSON size = 174,actual size = 412 , uri_size = 18
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:
Nov 2 19:21:41.919 Central: Dev reg json buffer :{"model":"B77A7561C7F4ABC92C07D7DCB68961470000A553","macAddress":"CC46D6CCCCCC","label":"global","tag":"global","serialNumber":"9BRCYQ9KDRU"} and bytes: 141
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:
Nov 2 19:21:41.919 Central: umbrella parameter-map name :global macAddr :cc46.d6cc.cccc 
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Build POST request invoked: post size = 238, size = 141
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Build POST request: hostname = api.opendns.com
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Build POST request: URI = /v3/networkdevices
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Build POST request done
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Send POST request for umbrella parameter-map global (tag: global): request buffer length = 368
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Send POST request for umbrella parameter-map global (tag: global): Built request = POST /v3/networkdevices HTTP/1.1
Host: api.opendns.com
Authorization:OpenDNS,api_key="B0E16D19C32D42EC996B635X4X9005B9",token="B77A8731C7F4D6E92C07D7DCB68961470000A553"
Content-Type: application/json
Content-Length: 141

{"model":"B77A8731C7F4D6E92C07D7DCB68961470000A553","macAddress":"CC46D6CCCCCC","label":"global","tag":"global","serialNumber":"9BRCYQ8RDRU"}
----------------------------------------<OUTPUT OMITTED>----------------------------------------
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Registration response: msg_part = 3, bytes = 256, resp: content-type: application/json
x-envoy-upstream-service-time: 1462
x-xss-protection: 1; mode=block
x-ingress-point: mil1

{"deviceId":"010a7859d0d39393","deviceKey":"B77A8731C7F4D6E92C07D7DCB68961470000A553-CC46D6CCCCCC-global","label":"global","serialNumber":"9BRCYQ8RDRU"}
Nov 2 19:21:41.919 Central: UMBRELLA-DEV-REG:Registration response: msg_part = 4, bytes = 1
78, resp: lNumber":"9KZNYR9FPPQ","phishing":1,"createdAt":1635877282,"originId":573529511,"
apiKey":"b0e16d19c32d42ec996b635x4x9005b9","deviceTypeId":1,"vendorId":51,"organizationId":xxxxx}

此处，POST请求包含API令牌（来自Cisco Umbrella控制面板的传统设备API令牌）、API密钥、型号（与API令牌相同）、无线LAN控制器(WLC)的MAC地址、参数映射名称（标记）和设备序列号。

设备ID使用API令牌、API密钥、标记和MAC地址生成。因为这两个9800具有相同的上述值，所以为它们分配相同的设备ID。

这是预料之中的行为。要解决此问题，您必须在9800的一个或两个上创建自定义参数映射;

parameter-map type umbrella <custom name>

通过创建自定义参数映射“cpm”，我们将创建一个新标记，该标记将产生不同的设备ID(deviceId)。

{"deviceId":"010a30f6275c92ce","deviceKey":"0DCDA24CDD6A92D714FE357539FDCAE80051BA0A-DD46D6BBCCCC-global","label":"global","serialNumber":"F222424Q4M8","phishing":1,"createdAt":1641192490,"originId":563829932,"apiKey":"b0e16d15c32d4e8c996b635afa9005b9","deviceTypeId":1,"vendorId":51,"organizationId":******}

{"deviceId":"010a341b037ea6b9","deviceKey":"0DCDA24CDD6A92D714FE357539FDCAE80051BA0A-DD46D6BBCCCC-cpm","label":"global","serialNumber":"F222424Q4M8","phishing":1,"createdAt":1641825561,"originId":563829932,"apiKey":"b0e16d15c32d4e8c996b635afa9005b9","deviceTypeId":1,"vendorId":51,"organizationId":******}

修订历史记录

版本	发布日期	备注
1.0	30-Sep-2025	初始版本

由思科工程师提供

此文档是否有帮助?

反馈

联系我们

提交支持案例
(需要思科服务合同)