Monday, March 18, 2013

How to Configure Cisco 1242 Wireless AP?



This Cisco 1242 wireless access point (AP), designed for business-grade users, and is ideal if you have a lot of traffic and you need reliability and some advanced features. For a business, I would never install any consumer-grade AP unless I was looking for trouble. The reason is that those consumer-grade APs (the ones you can buy at your local electronics store) just don't have the capabilities, the reliability of connections, the troubleshooting, or the throughput to do what you need them to do.
Here is a photo of the Cisco 1242AG

Here is a photo of the front of the AP:

As you can see, this AP has a power connection port (which goes to an AC/DC adapter), a console port, Ethernet port (to connect to the physical LAN), and indicator lights. You can also power the AP over the Ethernet wire with PoE (802.3af) on this model of AP, you will notice four black rubber covers. These cover the connectors for the wireless antennas (two on the front and two on the back).

On the front of the AP are the two antenna connectors for the 2.4Ghz network, with the right connector being the primary. On the back are the connectors for the 5Ghz network. These antennas can be bought separately and are required only if you want to extend the range in some way or do point-to-point bridging between APs. In a business network, you often want to extend or shape the wireless range, both for coverage and security. In that case, you would want to investigate and use the external antennas.

The Cisco 1242 offers the following:
  • A, B and G wireless protocols in the 2.4Ghz and 5Ghz wireless ranges
  • A long list of security protocols that you won't find in consumer-grade APs
  • Intrusion detection and prevention
  • Hardware-assisted AES encryption
  • Locking mounting bracket and a rugged NEMA metal case
  • Compatibility with Cisco's wireless management applications
  • That Cisco IOS CLI look and feel that we are used to configuring (or a Web browser interface if you so desire)
You can find more specifics on these APs at the Cisco homepage for the Aironet 1242 series.
Configuring the Cisco 1242 wireless AP Step by Step
Here are the steps I took to get my wireless AP functioning on my network:
1. Connect to power and LAN Ethernet
2. AP obtains IP address from DHCP server. I went to my DHCP server and found the IP address that it had obtained:

Alternatively, you can configure a static IP address on the AP using the console port, like this:
3. Point your Web browser to the AP. In my case, the DHCP-obtained IP address was 192.168.1.106. The default login (console or Web) is Cisco and Cisco (not cisco and cisco) for the username and password. Here is what I saw:

Notice how both the 2.4Ghz and 5Ghz radios show to be "down." On APs with version 12.3(4)JA and above, the wireless radio is disabled by default, and there is no SSID configured. This is for security reasons.
Also, note on the menu selections for the interface that there are options for Express Setup and Express Security. If these are available, why not use them?
4. Click on Express Setup. Notice the changes I made in the following screen. Not all of these are required. I changed the AP's name, set it to a static IP, changed the SNMP community string, and took the default of "Access Point" for both radios.

Next, I clicked Apply. I was redirected to the new IP address of the AP and I had to log in again.
5. Next, I clicked on Express Security and set the SSID, the SSID to be broadcast, and 40bit WEP encryption with a static key (basic, I know -- but just an example).

6. There are two important things still left to do -- change the admin password and enable the radios. To enable the radios, I clicked in Network Interfaces, on the left. In my case, I was only using the 2.4Ghz radio so I clicked on Radio0-802.11G, then on the Settings tab. I clicked on Enable for the radio and took all the other default settings.

At the bottom of the page, I clicked "Apply."
7. Finally, let's change the admin password so that no one else can get into our AP. To do this, I clicked on Security on the left hand side, then Admin Access. From here, I changed the default Authentication password and clicked Apply. I had to reauthenticate to the AP.
Then I created a new account called Admin with a secure password, and Read-Write capability (clicked Apply). After that, I deleted the default Cisco account (clicked Apply).
Here is what it looked like:

Note that we still have a single global password for all users. You may want to change this so that individual users will have their own passwords.
8. At this point, I could see the wireless network from my Windows computer and could successfully connect to it using the configured WEP key. My computer received a DHCP IP address from my DHCP server.

More Related Cisco Aironet 1240 AG Series
1900 cisco modules, 1900 cisco card, cisco 1900 interfaces, 1900 cisco interfaces

Friday, March 15, 2013

From Technical User: Open Port 873 on Cisco 1921



Caskibum’s Problem of Opening Port 873 on Cisco 1921
I have a Cisco 1921 and need to open ports 22 (SSH) and 873 (rsync) to run an rsync server on my network and the rest of the network needs standard "internet" access.  I am fairly new to Cisco ACLs and so I expect I'm doing something stupid but not sure what.When I add the ip access-group XXX in / out to the gig0/0 interface, I lose all www functionality at that point.Here is my current (working) config with the ACLs listed (101 and 102) but not enabled on the gig0/0 interface.I have tried the "established" statement at the start and end of the 101 list, no difference.Thanks for any help!
Router#show run
Building configuration...
Current configuration : 2675 bytes
!
! Last configuration change at 15:03:45 UTC Sun Dec 18 2011 by
!
version 15.0
service timestamps debug datetimemsec
service timestamps log datetimemsec
service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$Sx2k$wiHT8Af585IB/HsSZkwC61
enable password 7 073E325F19190C1D47
!
noaaa new-model
!
no ipv6 cef
ip source-route
ipcef
!
!
noipdhcp use vrf connected
ipdhcp excluded-address 10.1.0.1 10.1.0.149
ipdhcp excluded-address 10.1.0.200 10.1.0.254
!
ipdhcp pool net_dhcp
   import all
   network 10.1.0.0 255.255.255.0
   default-router 10.1.0.1
   lease 0 0 5
!
!
noip
domain lookup
ip
domain name treeskier.ca
multilink bundle-name authenticated
!
!
!
licenseudipid CISCO1921/K9 sn FGL15092836
!
!
username blah password blahblah
!
!        
ipssh version 2
!
!
!
!
interface GigabitEthernet0/0
 description Internet
 ipdhcp client update dns
 ip address dhcp
 ipnat outside
! ip access-group 101 in
! ip access-group 102 out
! once I turn these on, it all dies.
 ip virtual-reassembly
 duplex auto
 speed auto
 no cdp enable
 no mop enabled
!
interface GigabitEthernet0/1
 description internal
 ip address 10.1.0.1 255.255.255.0
 ipnat inside
 ip virtual-reassembly
 duplex auto
 speed auto
 no mop enabled
!
ip forward-protocol nd
!
ip http server
ip http authentication local
no ip http secure-server
!
ipnat inside source list 1 interface GigabitEthernet0/0 overload
ipnat inside source static tcp 10.1.0.102 873 interface GigabitEthernet0/0 873
ipnat inside source static tcp 10.1.0.102 22 interface GigabitEthernet0/0 22
!
access-list 1 permit 10.1.0.0 0.0.0.255
access-list 1 remark INSIDE_IF=gig0/1
access-list 101 permit tcp any 10.1.0.0 0.0.0.255 established
access-list 101 permit tcp any host 10.1.0.102 eq 22
access-list 101 permit udp any host 10.1.0.102 eq 22
access-list 101 permit tcp any host 10.1.0.102 eq 873
access-list 101 permit udp any host 10.1.0.102 eq 873
access-list 102 permit tcp 10.1.0.0 0.0.0.255 any
access-list 102 permit udp 10.1.0.0 0.0.0.255 any
dialer-list 1 protocol ip permit
!
!        
!
control-plane
!
banner login ^C**************************^C
!
CON and VTY setup
!
scheduler allocate 20000 1000
end
A bit of really basic troubleshooting:
Router#sh access-lists
Standard IP access list 1
    10 permit 10.1.0.0, wildcard bits 0.0.0.255 (9854736 matches)
Extended IP access list 101
    10 permit tcp any 10.1.0.0 0.0.0.255 established
    20 permit tcp any host 10.1.0.102 eq 22
    30 permit udp any host 10.1.0.102 eq 22
    40 permit tcp any host 10.1.0.102 eq 873
    50 permit udp any host 10.1.0.102 eq 873
Extended IP access list 102
    10 permit tcp 10.1.0.0 0.0.0.255 any
    20 permit udp 10.1.0.0 0.0.0.255 any

Router#shipnat translations
Pro Inside global         Inside local          Outside local         Outside global
tcp 192.168.0.10:22       10.1.0.102:22         ---                   ---
tcp 192.168.0.10:873      10.1.0.102:873        ---                   ---
tcp 192.168.0.10:54693    10.1.0.150:54693      208.88.180.96:80      208.88.180.96:80
tcp 192.168.0.10:54695    10.1.0.150:54695      208.88.180.96:80      208.88.180.96:80
tcp 192.168.0.10:54696    10.1.0.150:54696      208.88.180.106:5222   208.88.180.106:5222
tcp 192.168.0.10:54699    10.1.0.150:54699      208.88.181.46:1935    208.88.181.46:1935
tcp 192.168.0.10:54700    10.1.0.150:54700      208.88.180.96:80      208.88.180.96:80
... (more dynamic NAT at work)

Reply to Caskibum from Imbadatthis
You aren't allowing DNS in .
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml#allowdns
also a nice to know:
http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml#debugtraffic

After Imbadatthis‘s Reply
Caskibumsolved problems like this:
Thanks for the response. 
I actually sorted it out last night, my "new" cable modem was blocking the port forwarding before it got to the router.  So once I set up the NAT port forwarding on the cable modem, all good now.
Just FYI, I've ended up with a much simpler ACL and NAT setup:
!
ipnat inside source list nat-acl interface GigabitEthernet0/0 overload
ipnat inside source static tcp 10.1.0.101 873 interface GigabitEthernet0/0 873
ipnat inside source static tcp 10.1.0.101 22 interface GigabitEthernet0/0 22
!
ip access-list extended nat-acl
permitip 10.1.0.0 0.0.0.255 any
permittcp any host 10.1.0.101 eq 22
permittcp any host 10.1.0.101 eq 873
!
!
Best Regards

More discussion between these two buddies to talk about Opening port 873 on Cisco 1921
Imbadatthis: So you've removed both acl 101 and 102?

Caskibum:
Yep, the only ACL is the named extended list, which is applied on the outside interface in the overload command.I could have probably left them in place, I found this "alternate" solution with the named extended list as it is now, and then after that didn't work either I went to the cable modem and found the source of the problem.  I expect the 101 / 102 acls are fine if I were to use them.Then the two static NAT commands to handle the traffic direction.Seems to be working.I'm no security expert so if this leaves some gaping hole please let me know and I'll rework it.
Cheers!

More Related Discussion on Open port 873 on Cisco 1921at tek-tips.com
More Cisco News and Cisco Hardware Tips you can visit: