{"id":5995,"date":"2017-01-11T00:21:22","date_gmt":"2017-01-11T00:21:22","guid":{"rendered":"https:\/\/stevepedwards.today\/DebianAdmin\/?p=5995"},"modified":"2023-10-28T23:26:20","modified_gmt":"2023-10-28T22:26:20","slug":"cisco-setup-wifi-lan","status":"publish","type":"post","link":"https:\/\/stevepedwards.today\/DebianAdmin\/cisco-setup-wifi-lan\/","title":{"rendered":"Cisco Setup WiFi LAN and NTP – Full Config + Password Reset + Webpage Access"},"content":{"rendered":"
<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n

Because the WiFi setup is so complex and I can't begin to explain it, it's best to give the final working config including the Network Time Protocol settings that worked for me to set the 877s clock by so log files and Internet time is correct.<\/p>\n

cisco877#clock set 21:12:20 11 january 2017<\/span><\/p>\n

cisco877#sh clock<\/span>
\n21:13:11.295 London Wed Jan 11 2017<\/span><\/p>\n

The WiFi LAN sections are cryptic and involved as DHCP, NAT, ssid, encryption, power levels (research what dB is safe\/legal in your country! 0dB gives the same bars as my Draytek, so 128 dB may fry your eggs!):<\/p>\n

cisco877(config)#interface dot11Radio 0<\/span><\/p>\n

cisco877(config-if)#antenna gain ?<\/span>
\n<-128 - 128> Resultant Antenna Gain in dB<\/span><\/p>\n

and a bridging interface IP instead of a Vlan2 IP is required if the WiFi is going to connect fully to the other interfaces if it is to be setup without routing protocols, as it cannot be on the same subnet as the LAN (Vlan1).<\/p>\n

For these Vlans to communicate also requires other Cisco additions like a helper address to route packets between Vlan1 and BVI2 and not try to exit the default gateway in search of each other. All\u00a0interfaces have to be set ON remember!! No Shutdown<\/span>!<\/p>\n

As you have a WAN connection, you can get your ISP gateway IP from<\/p>\n

sh ip route<\/span><\/p>\n

C 195.166.130.254 is directly connected, Dialer1<\/span><\/p>\n

S* 0.0.0.0\/0 [1\/0] via 195.166.130.254<\/span>
\n is directly connected, Dialer1<\/span><\/p>\n

My original full working config for my\u00a0unit is below - amend it to suit - some is probably unnecessary, but if it ain't broke, don't fix it..:<\/p>\n

!
\nversion 12.4
\nservice nagle
\nno service pad
\nservice timestamps debug datetime msec
\nservice timestamps log datetime msec
\nservice password-encryption
\n!
\nhostname cisco877
\n!
\nboot-start-marker
\nboot-end-marker
\n!
\nenable secret 5\u00a0xxxx
\nenable password 7\u00a0xxxx
\n!
\nno aaa new-model
\nclock timezone London 0
\nclock summer-time BST recurring last Sun Mar 2:00 last Sun Oct 2:00
\nclock save interval 8
\n!
\ndot11 ssid cisco
\nvlan 2
\nauthentication open
\nauthentication key-management wpa
\nguest-mode
\nmbssid guest-mode
\nwpa-psk ascii 7\u00a0xxxx
\n!
\ndot11 arp-cache optional
\nno ip source-route
\nip cef
\n!
\n!
\nip dhcp use vrf connected
\nip dhcp excluded-address 192.168.1.21 192.168.1.254
\nip dhcp excluded-address 192.168.1.1 192.168.1.2
\nip dhcp excluded-address 192.168.2.1 192.168.2.2
\nip dhcp excluded-address 192.168.2.21 192.168.2.254
\n!
\nip dhcp pool CLIENT
\nimport all
\nnetwork 192.168.1.0 255.255.255.0
\ndefault-router 192.168.1.1
\ndns-server 8.8.8.8
\n!
\nip dhcp pool WIFI
\nimport all
\nnetwork 192.168.2.0 255.255.255.0
\ndefault-router 192.168.2.1
\ndns-server 8.8.8.8
\n!
\n!
\nip name-server 8.8.8.8
\nip name-server 212.159.13.49
\n!
\nmultilink bundle-name authenticated
\n!
\n!
\nbridge irb
\n!
\ninterface ATM0
\nno ip address
\nip nat outside
\nip virtual-reassembly
\nno atm ilmi-keepalive
\ndsl operating-mode auto adsl2 adsl2+
\n!
\ninterface ATM0.1 point-to-point
\nip address dhcp
\nip nat outside
\nip virtual-reassembly
\nno snmp trap link-status
\natm route-bridged ip
\natm pppatm link reset
\npvc 0\/38
\nencapsulation aal5snap
\nprotocol ppp dialer
\ndialer pool-member 1
\nip addr inarp
\n!
\n!
\ninterface FastEthernet0
\n!
\ninterface FastEthernet1
\n!
\ninterface FastEthernet2
\n!
\ninterface FastEthernet3
\n!
\ninterface Dot11Radio0
\ndescription WIFI vlan2
\nno ip address
\nno ip route-cache cef
\nno ip route-cache
\nno dot11 qos mode
\nno dot11 extension aironet
\n!
\nencryption vlan 2 mode ciphers aes-ccm tkip
\n!
\nssid cisco
\n!
\nspeed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
\nstation-role root access-point
\nrts retries 32
\nantenna gain 0
\nworld-mode dot11d country GB indoor
\nno cdp enable
\n!
\ninterface Dot11Radio0.1
\ndescription wireless vlan2
\nencapsulation dot1Q 2 native
\nip nat inside
\nip virtual-reassembly
\nno ip route-cache
\nno cdp enable
\nbridge-group 2
\nbridge-group 2 subscriber-loop-control
\nbridge-group 2 spanning-disabled
\nbridge-group 2 block-unknown-source
\nno bridge-group 2 source-learning
\nno bridge-group 2 unicast-flooding
\n!
\ninterface Vlan1
\nip address 192.168.1.1 255.255.255.0
\nip access-group LAN2WEB in
\nip helper-address 192.168.2.1
\nip helper-address 192.168.2.255
\nip directed-broadcast
\nip nat inside
\nip nat enable
\nip virtual-reassembly
\nip route-cache policy
\nip route-cache flow
\nip tcp adjust-mss 1452
\n!
\ninterface Vlan2
\nno ip address
\nip access-group LAN2WEB in
\nip nat inside
\nip nat enable
\nip virtual-reassembly
\nip route-cache policy
\nip route-cache flow
\nbridge-group 2
\nbridge-group 2 spanning-disabled
\n!
\ninterface Dialer1
\nip address negotiated previous
\nip access-group BLOCKWAN in
\nip nat outside
\nip nat enable
\nip virtual-reassembly
\nencapsulation ppp
\ndialer pool 1
\ndialer-group 1
\nautodetect encapsulation ppp
\nppp authentication chap pap callin
\nppp chap hostname user@plus.net
\nppp chap password 7\u00a0xxxx
\nppp ipcp wins request
\nppp ipcp mask request
\nppp ipcp route default
\nppp ipcp address accept
\n!
\ninterface BVI2
\nip address 192.168.2.1 255.255.255.0
\nip helper-address 192.168.1.1
\nip helper-address 192.168.1.255
\nip nat inside
\nip virtual-reassembly
\n!
\nip default-gateway <YOUR ISP GW>
\nip forward-protocol spanning-tree
\nip forward-protocol udp ntp
\nip forward-protocol udp 445
\nip route 0.0.0.0 0.0.0.0 Dialer1
\n!
\n!
\nip http server
\nno ip http secure-server
\nip dns server
\nip nat pool WIFI 192.168.2.2 192.168.2.20 netmask 255.255.255.0
\nip nat pool CLIENT 192.168.1.2 192.168.1.20 netmask 255.255.255.0
\nip nat inside source list LAN2WEB interface Dialer1 overload
\n!
\nip access-list extended BLOCKWAN
\npermit tcp any any established
\npermit udp any any
\npermit udp host 91.189.89.198 eq ntp any
\ndeny ip any any
\nip access-list extended LAN2WEB
\npermit ip any any
\npermit udp any any
\npermit icmp any any
\n!
\ndialer-list 1 protocol ip permit
\nsnmp-server community public RO
\n!
\n!
\n!
\n!
\ncontrol-plane
\n!
\nbridge 1 protocol ieee
\nbridge 1 route ip
\nbridge 2 protocol ieee
\nbridge 2 route ip
\n!
\nline con 0
\nno modem enable
\nline aux 0
\nline vty 0 4
\npassword 7 03145404161F2E435E
\nlogin
\n!
\nscheduler max-task-time 5000
\nntp clock-period 17179101
\nntp server 91.189.89.198 prefer
\nend<\/p>\n

As any lines with a hyphen cause fails it seems...all that can be done here is conf t<\/span> and try to paste it in section by section\u00a0and see what fails as incomplete, then add line by line for what's missing, bad Cisco!<\/p>\n

Again, a reload required.<\/p>\n

System configuration has been modified. Save? [yes\/no]: yes<\/span><\/span>
\nBuilding configuration...<\/span>
\n[OK]<\/span>
\nProceed with reload? [confirm]\u00a0y<\/span><\/span><\/p>\n

See if the SSID is visible on a WIFI phone or laptop:<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

If you have to reset a Cisco device password<\/strong>, usually the Break command or equal, depending on Terminal used, allows the confreg change - see here:<\/p>\n

https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/routers\/10000-series-routers\/12818-61.html<\/a><\/span><\/p>\n\n\n\n
\n\n\n\n
 <\/p>\n
Contents<\/span><\/div>\n
\n
\n
\n
Introduction<\/a><\/div>\n
Prerequisites<\/a><\/div>\n
Requirements<\/a><\/div>\n
Components Used<\/a><\/div>\n
Conventions<\/a><\/div>\n
Standard Break Key Combinations<\/a><\/div>\n
Tips to Troubleshoot<\/a><\/div>\n
How to Simulate a Break Key Sequence<\/a><\/div>\n
Related Information<\/a><\/div>\n
Related Cisco Support Community Discussions<\/a><\/div>\n<\/div>\n

Introduction<\/h2>\n

This document provides standard break key sequence combinations for the most common operating systems, and some tips on how to troubleshoot problems.<\/p>\n

The Electronic Industries Association<\/a> \"leavingcisco.com\" RS-232 logic level uses +3 to +25 volts to signify a Space (Logic 0) and -3 to -25 volts for a Mark (logic 1). A break signal is when the data line remains in the space condition for a specified duration, usually 100 ms to \u00bd second. All characters begin with a start bit and end with a stop bit (and also a parity bit or two). The level condition of the start and stop bits is always opposite. So, no character combination can look like the break signal. A break signal enables you to access a ROM Monitor on Cisco IOS\u00ae devices when a password recovery is necessary.<\/p>\n

Prerequisites<\/h2>\n

Requirements<\/h3>\n

There are no specific requirements for this document.<\/p>\n

Components Used<\/h3>\n

This document is not restricted to specific software and hardware versions.<\/p>\n

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.<\/p>\n

Conventions<\/h3>\n

Refer to Cisco Technical Tips Conventions<\/a> for more information on document conventions.<\/p>\n

Standard Break Key Combinations<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n
Software<\/th>\nPlatform<\/th>\nOperating System<\/th>\nTry This<\/th>\n<\/tr>\n
Hyperterminal<\/td>\nIBM Compatible<\/td>\nWindows XP<\/td>\nCtrl-Break<\/td>\n<\/tr>\n
Hyperterminal<\/td>\nIBM Compatible<\/td>\nWindows 2000<\/td>\nCtrl-Break<\/td>\n<\/tr>\n
Hyperterminal<\/td>\nIBM Compatible<\/td>\nWindows 98<\/td>\nCtrl-Break<\/td>\n<\/tr>\n
Hyperterminal (version 595160)<\/td>\nIBM Compatible<\/td>\nWindows 95<\/td>\nCtrl-F6-Break<\/td>\n<\/tr>\n
Kermit<\/td>\nSun Workstation<\/td>\nUNIX<\/td>\nCtrl-\\l<\/td>\n<\/tr>\n
Ctrl-\\b<\/td>\n<\/tr>\n
MicroPhone Pro<\/td>\nIBM Compatible<\/td>\nWindows<\/td>\nCtrl-Break<\/td>\n<\/tr>\n
Minicom<\/strong><\/span><\/td>\nIBM Compatible<\/td>\nLinux<\/td>\nCtrl-a f<\/strong><\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

This means press CtrlA.....(release) then F.<\/p>\n

\"\"<\/a><\/p>\n

https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/routers\/800-series-routers\/12065-pswdrec-827.html<\/span><\/a><\/p>\n

\"\"<\/a><\/p>\n

Press Break on the terminal keyboard within 60 seconds of power up in order to put the router into ROMMON.
\nIf the break sequence does not work, refer to Standard Break Key Sequence Combinations During Password Recovery for other key combinations.
\nType confreg 0x2142<\/span> at the rommon 1> prompt in order to boot from Flash.
\nThis step bypasses the startup configuration where the passwords are stored.
\nType reset<\/span> at the rommon 2> prompt.
\nThe router reboots, but ignores the saved configuration.
\nType no after each setup question, or press Ctrl-C in order to skip the initial setup procedure.
\nType enable<\/span> at the Router> prompt.
\nYou are in enable mode and should see the Router# prompt.
\nType configure memory<\/span> or copy startup-config running-config<\/span> in order to copy the nonvolatile RAM (NVRAM) into memory.
\nImportant: Do not type copy running-config startup-config or write. These commands erase your startup configuration.
\nType show running-config<\/span>.
\nThe show running-config command shows the configuration of the router. In this configuration, the shutdown command appears under all interfaces, which indicates all interfaces are currently shut down. In addition, the passwords (enable password, enable secret, vty, console passwords) are in either an encrypted or unencrypted format. You can reuse unencrypted passwords. You must change encrypted passwords to a new password.
\nType configure terminal<\/span>.
\nThe hostname(config)# prompt appears.
\nType enable secret <password><\/span> in order to change the enable secret password. For example:
\nhostname(config)#enable secret cisco<\/span><\/p>\n

Issue the no shutdown command on every interface that you use.
\nIf you issue a show ip interface brief<\/span> command, every interface that you want to use should display up up.
\nType config-register <configuration_register_setting>. Where configuration_register_setting is either the value you recorded in step 2 or 0x2102 . For example:
\nhostname(config)#config-register 0x2102<\/span><\/p>\n

Press Ctrl-z or end<\/span> in order to leave the configuration mode.
\nThe hostname# prompt appears.
\nType write memory or copy running-config startup-config<\/span> in order to commit the changes.<\/p>\n

The HTTP server is active and can be accessed via a browser for a wealth of support and setup info:<\/p>\n

\"\"<\/a><\/p>\n

This is the quickest way to find line stat info e.g. search \"speed\"<\/p>\n

\"\"<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/div>\n

<\/path><\/svg><\/i> \"Loading\"<\/p>\n

<\/div>\n

Because the WiFi setup is so complex and I can't begin to explain it, it's best to give the final working config including the Network Time Protocol settings that worked for me to set the 877s clock by so log files and Internet time is correct. cisco877#clock set 21:12:20 11 january 2017 cisco877#sh clock 21:13:11.295 ...\u00a0 Cisco Setup WiFi LAN and NTP – Full Config + Password Reset + Webpage Access<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-5995","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"a3_pvc":{"activated":true,"total_views":9,"today_views":0},"_links":{"self":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/5995","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/comments?post=5995"}],"version-history":[{"count":2,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/5995\/revisions"}],"predecessor-version":[{"id":10070,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/posts\/5995\/revisions\/10070"}],"wp:attachment":[{"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/media?parent=5995"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/categories?post=5995"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/stevepedwards.today\/DebianAdmin\/wp-json\/wp\/v2\/tags?post=5995"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}