ISE - Authentication Policy Fields

If the Compound Condition and Result are True, Authenticate against the Identity Source.

How to Install a Certificate from an Internal CA on ISE

Note: This assumes that your clients are already configured to trust the Internal CA as a Trusted Root Authority.  This is usually handled by a GPO.

Download the CA root certificate
Navigate to https://certserver/certsrv
Click Download a CA certificate, certificate chain, or CRL
Highlight the CA certificate and click Download CA certificate
Save the file to your hard drive.


Install the CA root certificate
Log into ISE
Click Administration > System > Certificates > Certificates Store > Import
Select the file you've downloaded earlier
Enter a Friendly Name
Highlight Trust for client authentication or Secure Syslog services
Click Submit

Create a Certificate Signing Request
Click Administration > System > Certificates > Local Certificates > Add
Click Generate Certificate Signing Request
Set Certificate Subject to FQDN
Add Subject Alternative Names
Set Key Length to 2048 and Digest to Sign with to SHA-256
Click Submit
Open Administration > System > Certificates > Certificate Signing Requests
Select the CSR and click Export
Save the file to your hard drive

Request a Certificate from the CA using the CSR
Navigate to https://certserver/certsrv
Click Request a Certificate
Click Advanced Certificate Request
Click the Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file
Copy the contents of the CSR (.pem file) and Paste into the "Base-64-encoded certificate request" window
Under Certificate Template, choose Web Server
Click Submit
Hightlight DER encoded and click Download Certificate
Save the certificate to your hard drive

Install the Certificate in ISE
Log into ISE
Click Administration > System > Certificates > Local Certificates > Add
Click Bind CA signed Certificate
Browse to the certificate file you have just saved.
Enter a Friendly name
Select EAP and HTTP under Protocol
*WARNING* Clicking Submit will Reboot ISE
Click Submit

NETSH WLAN Cheat Sheet

netsh wlan show interface
(Shows BSSID, Authentication Type, Encryption, Channel, Transmit/Receive rate, etc.)

netsh wlan show profiles
(Shows wlan profiles settings)

netsh wlan show networks mode=BSSID
(Shows all BSSIDs with Channel info and received signal strength)

Cisco AP Associated to Controller, but no clients connected

Ensure that "Admin Status" is set to Enabled.
Ensure radios are Enabled.

Ensure it is in local mode (not monitor mode).

Verify the country code is set correctly (some APs may be in UX or Universal mode).

Verify it is in the correct AP Group

How to Update Kali Sources List

Edit the /etc/apt/sources.list file

vi /etc/apt/sources.list

Type i to enter INSERT mode

Add the Kali Rolling Repository

deb http://http.kali.org/kali kali-rolling main contrib non-free

Hit ESC to exit INSERT mode

Type :wq to write changes and quit

Then update apt-get to have the new repository take effect.
apt-get update

How to Configure FreeRadius on Kali for 802.1X Authentication

Install FreeRadius on Linux
apt-get install Freeradius*

Define a Client (Wireless Controller)
vi /etc/freeradius/3.0/clients.conf

Type i to enter INSERT mode

client name {
ipaddr = <ip address>
secret = secret-password
}

Hit ESC to exit INSERT mode

Type :wq to save changes and exit

Define a User and Password

vi /etc/freeradius/3.0/users

username Cleartext-Password := "password"

Save changes and exit

Start the Radius Server in debugging mode
freeradius -X

Test the configuration
radtest username password localhost 0 testing123

*testing123 is the default password for "localhost"


To Enable PEAP:
Edit /etc/freeradius/3.0/mods-enabled/eap
vi /etc/freeradius/3.0/mods-enabled/eap
Set the default eap type to peap

Configure MSChapv2
vi /etc/freeradius/3.0/mods-enabled/mschap
Set "use_mppe" to yes
Set "require_encryption" to yes
Set "require_strong" to yes

Restart freeradius to have changes take effect
killall freeradius
freeradius -X

How to Delete Checkboxes that were Pasted into Excel

Click File > Options > Customize Ribbon
Enable Developer mode
Click the Developer tab
Click the Design Mode button
Highlight the checkbox and delete.

Configure Switch for WLC Link Aggregation

config t

int range fa0/47 - 48
switchport
channel-group 1 mode on

no shut

int port-channel 1
switchport
switchport trunk encap dot1q
switchport trunk native vlan x
switchport trunk allowed vlan x,y,z
switchport mode trunk
no shut

WireShark Capture Filter based on MAC Address

ether host <mac>

How to Configure Options 43 and 60 in DHCP on Cisco 3850

ip dhcp pool test-pool
network 192.168.21.0 255.255.255.0
dns-server 8.8.8.8
domain-name test.local
default-route 192.168.21.1
option 60 ascii "VCI string"
option 43 hex string

(string = f1 + (number of controllers*4) + (hex value of ip addresses))
For instance, if you had 2 controllers with 192.168.20.10 and 192.168.20.11:

string = F1 + (2*4) + C0A8140A + C0A8140B = F108C0A8140AC0A8140B

ip dhcp excluded-address 192.168.21.1 192.168.21.100

How to SPAN a port on a Cisco 2960

config t
no monitor session all
monitor session 1 source interface fa0/1
monitor session 1 destination interface fa0/2 encapsulation replicate

How To Configure Cisco 3702i as an Autonomous AP - (To be used as an AP on a Stick)

Change the IOS

1.       Set your computer’s ip address to 10.0.0.10/8.

2.       Download the Autonomous IOS from Cisco

3.       Rename the IOS image ap3g2-k9w7-tar.default and place it in the TFTP Root folder (C:\tftp-root)

4.       Connect your computer to the Ethernet Port

5.       Console into the AP

6.       Verify the TFTP Server service is running on your computer

7.       Reboot into Recovery mode by holding down the mode button while powering on the AP.

(The mode button is just to the left of the Console Port)

8.       Release the mode button when notified

The AP should find your TFTP Server and start downloading/installing the new Autonomous IOS image.  It will reboot on its own when it is complete.

Set the AP’s IP Address

ap> enable

Password: Cisco

Ap# config t

int BVI 1

ip address 10.0.0.1 255.0.0.0

No shut

Create a WLAN from HTTP

1.       Set your computer’s IP Address to 10.0.0.10/8

2.       Navigate to http://10.0.0.1

a.       Username: <blank> Password: Cisco

3.       Click Easy Setup à Network Configuration

a.       Configure the 2.4GHz radio and Apply

b.      Configure the 5GHz radio and Apply

                                                               i.      Enable the radio

Save Configuration!

Distributed Coordinated Function (DCF)

How to Import a Page from a Multi-Page PDF into Ekahau as a Map on a MAC

This is more of a convert to .png, then import in Ekahau.

Open the PDF with Preview in Mac.  Preview is the default pdf viewer, but you may have to Control+Click to display the Open With option if you've changed the default.

Once the PDF is open in Preview, ensure the Thumbnails are displayed.  Highlight the page you want as a map and click Edit > Copy or Command+C.

Then click File > New from Clipboard

Then Click File > Save

Change the Format to .png and save the file.

Then, import the .png as a map in Ekahau.

How to Configure TKIP on Cisco 5520 WLC

TKIP has been deprecated since the 2012 802.11 Standard and should no longer considered a secure encryption type. However, if you must use TKIP to support legacy devices in your environment, here is how to enable it on a Cisco 5520 WLC.

Cisco has disabled the ability to enable TKIP from the GUI.  It must now be done from the command line.

config wlan disable <wlan-id>

config wlan security wpa wpa2 ciphers tkip enable <wlan-id>

config wlan enable <wlan-id>

802.11ac non-overlapping channels for 20Mhz, 40MHz, and 80MHz channel widths