Who's the Man Blog

Just another WordPress.com weblog

recent posts

about

HP WX Series FIT APs (formerly A-Series or H3C) Syslog Trick

I have found one of the main issues with FIT Aps on WX Controllers is the inability to monitor them effectively. I wish there was a way to monitor them with SNMP directly but it is disabled in most models. I have found that you can enable syslog via config file. I add a config file to all devices with a simple line below, this enable syslog to a server of IP 192.168.1.1.

 

Info-center loghost 192.168.1.1

 

To perform this create a text file of just this setting and upload it your controller via the webpage or tftp. Now under each configured AP add the file name I always add it under autoap config. In this example the file is called 7760config.txt.

 

The first thing I found out was that many of my FIT Aps were complaining (to themselves until I added the syslog) that the MAC-Address Table was full due to having too many VLANs trunked to the AP ports.

 


 

Posted in

7 responses to “HP WX Series FIT APs (formerly A-Series or H3C) Syslog Trick”

  1. thiagocella Avatar
    thiagocella

    Hi,

    Could you explain , how did you do to fix the error : “Mac address table full” ??

    tks

    Reply
    1. whostheman Avatar
      whostheman

      The reason I was getting MAC address table full was because I had set up the ports as trunking so all vlans and all mac-addresses in those vlans could eventually end up in the table. I changed my configuration to only include vlans necessary for operation, if you are experiencing this same issue but only have one vlan defined on your network I would recommend separating your wireless clients onto their own vlan.

      Reply
  2. thiagocella Avatar
    thiagocella

    Tks !!

    I ´ll try set only the vlans that SSIDs uses.

    After i let you know the results!!

    Reply
  3. thiagocella Avatar
    thiagocella

    Hi Whosteman,

    Unfortunately, didnt work. Do you have other idea?

    Obs: The access-point is running with Controller WX5002, is there any way to active telnet connection to this access-point?

    TKs

    Reply
    1. whostheman Avatar
      whostheman

      to enable telnet you need to use the hidden commands:

      at the command prompt :

      _hidecmd
      wlan ap-execute apname exec-control enable
      wlan ap-execute apname telnet enable

      now you should be able to telnet into the AP without a password

      Reply
      1. thiagocella Avatar
        thiagocella

        Tks, I´ll try.

  4. thiagocella Avatar
    thiagocella

    I need your help, i´m posting my controller config, could help
    in the follow questions?

    – When the access-point are registred in the Controller, we
    dont access them by telnet, what config in the controller we
    have to change?

    – The clients are not connecting automatically to access-point
    with best signal. For example, i connect on access-point in my room,
    but when i go with my notebook near to access-point in another room,
    i still connected on access-point in my room.Appers that Controller
    isnt balancing the clients.

    – The problem “Mac address table full” is still occuring, whe i change
    the managed IP of access-point, they do not register on the controller,
    only register with i back the IP of network that message is appearing.

    Controller Config:

    #
    version 5.20, Release 2308P10
    #
    #
    #
    #
    dns resolve
    dns proxy enable
    dns server 172.25.0.130
    dns server 172.25.0.131
    #
    telnet server enable
    #
    ip ttl-expires enable
    #
    user-isolation vlan 50 enable
    user-isolation vlan 50 permit-mac 0017-c5ae-d95c
    #
    port-security enable
    port-security trap ralmlogon
    —- More —-  port-security trap ralmlogoff
    port-security trap ralmlogfailure
    #
    dot1x authentication-method eap
    #
    mac-authentication user-name-format mac-address without-hyphen uppercase
    #
    wlan country-code BR
    #
    wlan backup-ac ip 10.10.0.122
    #
    acl number 3333
    rule 0 deny ip destination 10.10.0.0 0.0.255.255
    rule 5 deny ip destination 192.168.0.0 0.0.1.255
    rule 10 deny ip destination 10.66.0.0 0.0.0.255
    rule 15 deny ip destination 172.16.0.0 0.0.255.255
    rule 20 deny ip destination 10.11.0.0 0.0.255.255
    rule 25 deny ip destination 10.12.0.0 0.0.255.255
    rule 30 deny ip destination 10.1.0.0 0.0.255.255
    rule 35 deny ip destination 10.2.0.0 0.0.255.255
    rule 40 deny ip destination 10.3.0.0 0.0.255.255
    rule 50 deny ip destination 172.25.0.0 0.0.7.255
    rule 60 deny ip destination 172.26.0.0 0.0.7.255
    —- More —-  rule 70 deny ip destination 172.27.0.0 0.0.255.255
    rule 80 deny ip destination 172.30.0.0 0.0.0.255
    rule 90 deny ip destination 10.100.0.0 0.0.255.255
    rule 100 deny ip destination 172.22.0.0 0.0.255.255
    rule 105 deny ip destination 10.13.0.0 0.0.255.255
    acl number 3334
    rule 0 permit udp destination 8.8.8.8 0 destination-port eq dns
    rule 5 permit tcp destination 172.25.0.185 0 destination-port eq 8080
    #
    vlan 1
    #
    vlan 6
    #
    vlan 10
    #
    vlan 22
    #
    vlan 31
    #
    vlan 40
    #
    vlan 50
    #
    —- More —- vlan 70
    #
    vlan 75
    #
    vlan 90
    #
    radius scheme system
    radius scheme portalradius
    primary authentication 172.25.0.185
    primary accounting 172.25.0.185
    key authentication cipher pass
    key accounting cipher pass
    user-name-format without-domain
    radius scheme macradius
    primary authentication 192.168.0.50
    primary accounting 192.168.0.50
    key authentication cipher pass
    key accounting cipher pass
    user-name-format without-domain
    radius scheme byod
    primary authentication 172.25.0.185
    primary accounting 172.25.0.185
    key authentication cipher pass
    —- More —-  key accounting cipher pass
    user-name-format without-domain
    nas-ip 10.10.0.121
    radius scheme radius_802.1x
    server-type extended
    primary authentication 172.25.0.165
    primary accounting 172.25.0.165
    key authentication cipher pass
    key accounting cipher pass
    user-name-format without-domain
    nas-ip 10.10.0.121
    #
    domain byod
    authentication lan-access radius-scheme byod
    authorization lan-access radius-scheme byod
    accounting lan-access radius-scheme byod
    access-limit disable
    state active
    idle-cut disable
    self-service-url disable
    domain macdomain
    authentication lan-access radius-scheme macradius
    authorization lan-access radius-scheme macradius
    —- More —-  accounting lan-access radius-scheme macradius
    access-limit disable
    state active
    idle-cut disable
    self-service-url disable
    domain portaldomain
    authentication portal radius-scheme portalradius
    authorization portal radius-scheme portalradius
    accounting portal radius-scheme portalradius
    access-limit disable
    state active
    idle-cut disable
    self-service-url disable
    domain radius_802.1x
    authentication lan-access radius-scheme radius_802.1x
    authorization lan-access radius-scheme radius_802.1x
    accounting lan-access radius-scheme radius_802.1x
    access-limit disable
    state active
    idle-cut disable
    self-service-url disable
    domain system
    access-limit disable
    —- More —-  state active
    idle-cut disable
    self-service-url disable
    #
    traffic classifier fwdredesportalclass operator and
    if-match acl 3334
    traffic classifier blkredesportalclass operator and
    if-match acl 3333
    #
    traffic behavior fwdredesportalbeh
    filter permit
    traffic behavior blkredesportalbeh
    filter deny
    #
    qos policy redesportalpol
    classifier fwdredesportalclass behavior fwdredesportalbeh
    classifier blkredesportalclass behavior blkredesportalbeh
    #
    dhcp server ip-pool portalpool
    network 10.66.0.0 mask 255.255.255.0
    gateway-list 10.66.0.1
    dns-list 8.8.8.8
    #
    —- More —- dhcp server ip-pool portaltest
    network 172.21.2.0 mask 255.255.254.0
    gateway-list 172.21.2.1
    dns-list 172.21.2.1
    #
    dhcp server ip-pool _vip
    network 10.40.0.0 mask 255.255.255.0
    gateway-list 10.40.0.1
    dns-list 8.8.8.8
    #
    user-group system
    group-attribute allow-guest
    #
    local-user admin
    password cipher pass
    authorization-attribute level 3
    service-type ssh telnet terminal
    service-type web
    #
    stp enable
    #
    wlan rrm
    dot11a mandatory-rate 6 12 24
    —- More —-  dot11a supported-rate 9 18 36 48 54
    dot11b mandatory-rate 1 2
    dot11b supported-rate 5.5 11
    dot11g mandatory-rate 1 2 5.5 11
    dot11g supported-rate 6 9 12 18 24 36 48 54
    dot11g protection-mode rts-cts
    dot11a calibrate-channel self-decisive
    dot11a calibrate-power self-decisive
    dot11bg calibrate-channel self-decisive
    dot11bg calibrate-power self-decisive
    #
    wlan service-template 1 crypto
    ssid U
    bind WLAN-ESS 1
    cipher-suite tkip
    cipher-suite ccmp
    security-ie rsn
    security-ie wpa
    service-template enable
    #
    #
    wlan service-template 2 crypto
    ssid U-CORP-VISIT
    bind WLAN-ESS 2
    cipher-suite tkip
    cipher-suite ccmp
    security-ie rsn
    security-ie wpa
    service-template enable
    #
    wlan service-template 3 crypto
    ssid U-VISITS
    bind WLAN-ESS 3
    cipher-suite tkip
    cipher-suite ccmp
    security-ie rsn
    security-ie wpa
    service-template enable
    #
    #
    interface NULL0
    #
    interface Vlan-interface1
    ip address 10.10.0.121 255.255.0.0
    #
    interface Vlan-interface6
    ip address 10.66.0.1 255.255.255.0
    #
    interface Vlan-interface10
    ip address 10.12.0.241 255.255.255.0
    #
    interface Vlan-interface40
    ip address 10.40.0.2 255.255.255.0
    —- More —- #
    interface Vlan-interface90
    ip address 172.21.2.1 255.255.254.0
    #
    interface GigabitEthernet1/0/1
    port link-type trunk
    port trunk permit vlan all
    #
    interface GigabitEthernet1/0/2
    port link-type trunk
    port trunk permit vlan all
    #
    interface GigabitEthernet1/0/3
    port link-type trunk
    port trunk permit vlan all
    #
    interface GigabitEthernet1/0/4
    port link-type trunk
    port trunk permit vlan all
    #
    interface Ten-GigabitEthernet1/0/5
    #
    interface WLAN-ESS0
    —- More —-  port link-type hybrid
    port hybrid vlan 1 70 75 90 untagged
    mac-vlan enable
    port-security port-mode mac-authentication
    mac-authentication domain byod
    #
    interface WLAN-ESS1
    port access vlan 31
    port-security port-mode psk
    port-security tx-key-type 11key
    port-security preshared-key pass-phrase cipher pass
    #
    interface WLAN-ESS2
    port access vlan 22
    port-security port-mode psk
    port-security tx-key-type 11key
    port-security preshared-key pass-phrase cipher pass
    #
    interface WLAN-ESS3
    port access vlan 31
    port-security port-mode psk
    port-security tx-key-type 11key
    port-security preshared-key pass-phrase cipher pass
    —- More —- #
    interface WLAN-ESS4
    port access vlan 22
    port-security port-mode userlogin-secure-ext
    port-security tx-key-type 11key
    undo dot1x handshake
    undo dot1x multicast-trigger
    #
    interface WLAN-ESS6
    port access vlan 6
    qos apply policy redesportalpol inbound
    port-security preshared-key pass-phrase cipher pass
    undo dot1x handshake
    #
    interface WLAN-ESS10
    port access vlan 40
    port-security port-mode mac-authentication
    undo dot1x handshake
    #
    interface WLAN-ESS11
    port access vlan 50
    #
    interface WLAN-ESS12
    —- More —-  port access vlan 50
    port-security port-mode psk
    port-security tx-key-type 11key
    port-security preshared-key pass-phrase cipher pass
    dot1x mandatory-domain dd
    #
    nqa entry imclinktopologypleaseignore ping
    type icmp-echo
    destination ip 10.10.255.254
    frequency 270000
    #
    wlan ap ap27 model WA2620-AGN id 27
    priority level 6
    serial-id 219801XXXXXXXXXXXXXXXXXX
    client keep-alive 20
    radio 1
    max-power 8
    service-template 1
    service-template 2
    service-template 3
    radio enable
    radio 2
    service-template 1
    service-template 2
    service-template 3
    radio enable

    wlan ap ap28 model WA2620-AGN id 28
    priority level 6
    serial-id 219801XXXXXXXXXXXXXXXXXX
    client keep-alive 20
    radio 1
    max-power 8
    service-template 1
    service-template 2
    service-template 3
    radio enable
    radio 2
    service-template 1
    service-template 2
    service-template 3
    radio enable
    #
    #
    ip route-static 0.0.0.0 0.0.0.0 10.10.0.1
    ip route-static 10.12.0.0 255.255.0.0 10.10.0.1
    ip route-static 172.17.0.0 255.255.255.0 10.10.0.1
    ip route-static 172.25.0.0 255.255.248.0 10.10.0.1
    ip route-static 192.168.0.0 255.255.0.0 10.10.0.1
    #
    info-center loghost 192.168.0.50
    info-center logbuffer size 1024
    undo info-center logfile enable
    —- More —- #
    snmp-agent
    snmp-agent local-engineid 800063A203002389A48BE3
    snmp-agent community write pass
    snmp-agent log all
    snmp-agent sys-info version all
    snmp-agent target-host trap address udp-domain 192.168.0.50 params securityname pass
    snmp-agent target-host trap address udp-domain 192.168.1.152 params securityname pass
    #
    dhcp server forbidden-ip 10.66.0.1
    dhcp server forbidden-ip 10.40.0.1 10.40.0.3
    dhcp server forbidden-ip 10.90.0.1 10.90.0.10
    dhcp server forbidden-ip 172.21.2.1 172.21.2.10
    #
    dhcp enable
    #
    nqa schedule imclinktopologypleaseignore ping start-time now lifetime 630720000
    #
    ssh server enable
    #
    load xml-configuration
    #
    user-interface con 0
    —- More —-  authentication-mode scheme
    user-interface vty 0 4
    authentication-mode scheme
    user privilege level 3
    idle-timeout 0 0
    #
    return

    H3C Comware Platform Software
    Comware Software, Version 5.20, Release 2308P10
    Copyright (c) 2004-2012 Hangzhou H3C Tech. Co., Ltd. All rights reserved.
    H3C WX5004 uptime is 5 weeks, 1 day, 4 hours, 3 minutes

    H3C WX5004 with 1 RMI XLR 716 800MHz Processor
    1024M bytes DDR2
    4M bytes Flash Memory
    Config Register points to FLASH
    259M bytes CFCard Memory

    Hardware Version is Ver.B
    CPLD Version is 010
    Basic Bootrom Version is 1.10
    Extend Bootrom Version is 1.13
    [Subslot 0]EWPXM1EXPA0 Hardware Version is Ver.B

    Reply

Leave a Reply

Discover more from Who's the Man Blog

Subscribe now to keep reading and get access to the full archive.

Continue reading