version 8.3.0.0-8.3.0
syslocation "edificio ALEM 650/638"
virtual-controller-country BO
virtual-controller-key 46dc30930111850538ce3a4b3394c19c59e62488d21bab17f1
name "VC ALEM 650/638"
virtual-controller-ip 192.168.7.196
terminal-access
ntp-server 172.16.1.59
clock timezone Buenos-Aires -03 00
rf-band all
dynamic-radius-proxy

allow-new-aps
allowed-ap 48:4a:e9:ca:16:ae
allowed-ap 48:4a:e9:c9:64:74
allowed-ap 48:4a:e9:c9:50:2a
allowed-ap 48:4a:e9:c9:59:94
allowed-ap 48:4a:e9:c9:58:4c
allowed-ap 48:4a:e9:ca:30:24
allowed-ap 48:4a:e9:ca:32:be
allowed-ap 48:4a:e9:ca:49:4a
allowed-ap 48:4a:e9:ca:49:3c
allowed-ap 48:4a:e9:ca:4a:a6
allowed-ap 48:4a:e9:ca:30:fa
allowed-ap 48:4a:e9:ca:2d:0c
allowed-ap 48:4a:e9:ca:41:9e
allowed-ap 48:4a:e9:ca:1e:32
allowed-ap 48:4a:e9:ca:44:d6
allowed-ap 48:4a:e9:ca:40:a2
allowed-ap 48:4a:e9:ca:33:14
allowed-ap 48:4a:e9:ca:20:4e
allowed-ap 48:4a:e9:ca:25:ba
allowed-ap 48:4a:e9:ca:2f:66
allowed-ap 48:4a:e9:ca:52:2a
allowed-ap 48:4a:e9:ca:33:92
allowed-ap 48:4a:e9:ca:25:6e
allowed-ap 48:4a:e9:ca:31:bc



arm
 wide-bands all
 min-tx-power 18
 max-tx-power 127
 band-steering-mode prefer-5ghz
 air-time-fairness-mode default-access
 client-aware
 scanning
 client-match
 client-match calc-interval 30
 client-match slb-mode 3


syslog-level warn ap-debug 
syslog-level warn network 
syslog-level warn security 
syslog-level warn system 
syslog-level warn user 
syslog-level warn user-debug 
syslog-level warn wireless 


extended-ssid





user redes b66e0730545afcfeeba11021d972bccf portal




hash-mgmt-password
hash-mgmt-user admin password hash 7fc861f7024f330c63429b8a89c0611eeb19c2a000f4c3187dbfe3d2794c213af2dcc23c5c



wlan access-rule Trunk
 index 0
 rule any any match any any any permit

wlan access-rule default_wired_port_profile
 index 1
 rule any any match any any any permit

wlan access-rule wired-SetMeUp
 index 2
 rule masterip 0.0.0.0 match tcp 80 80 permit
 rule masterip 0.0.0.0 match tcp 4343 4343 permit
 rule any any match udp 67 68 permit
 rule any any match udp 53 53 permit

wlan access-rule GUEST
 index 3
 rule any any match any any any permit

wlan access-rule 8021x
 index 4
 rule any any match any any any permit

wlan access-rule solointernet
 index 5
 rule any any match any any any permit

wlan access-rule prueba
 index 6
 rule any any match any any any permit

wlan access-rule VIPTrabajo
 index 7
 rule any any match udp 67 68 permit
 rule any any match udp 53 53 permit
 rule 192.168.186.0 255.255.255.0 match any any any deny
 rule any any match any any any permit

wlan access-rule invitado
 index 8
 rule apip 0.0.0.0 match tcp 80 80 permit
 rule apip 0.0.0.0 match tcp 443 443 permit
 rule apnetwork 0.0.0.0 match udp 53 53 permit
 rule any any match any any any deny

wlan access-rule impresora
 index 9
 rule 192.168.169.13 255.255.255.255 match any any any permit
 rule any any match any any any deny

wlan access-rule pre-auth-skyfii
 index 10
 rule alias skyfii.com match any any any permit
 rule alias securelogin.hpe.com match any any any permit
 rule alias securelogin.arubanetworks.com match any any any permit
 rule alias facebook.com match any any any permit
 rule alias fbcdn.net match any any any permit
 rule alias linkedin.com match any any any permit
 rule alias licdn.com match any any any permit
 rule alias twitter.com match any any any permit
 rule alias twimg.com match any any any permit
 rule any any match any any any deny

wlan access-rule MinPyT
 index 11
 rule any any match any any any permit

wlan access-rule "Wifi Asesores"
 index 12
 rule any any match udp 67 68 permit
 rule any any match udp 53 53 permit
 rule 192.168.186.0 255.255.255.0 match any any any deny
 rule any any match any any any permit

wlan ssid-profile GUEST
 enable
 index 0
 type guest
 essid "WiFi Invitados"
 opmode opensystem
 max-authentication-failures 0
 vlan 192
 auth-server SkyFiiRADIUS
 auth-server SkyfiiRADIUSbkp
 set-role-pre-auth pre-auth-skyfii
 rf-band all
 captive-portal external profile Skifii-Guest-Wifi
 dtim-period 1
 inactivity-timeout 86400
 broadcast-filter arp
 deny-inter-user-bridging
 radius-reauth-interval 10080
 radius-accounting
 radius-interim-accounting-interval 1
 multicast-rate-optimization
 dynamic-multicast-optimization
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64

wlan ssid-profile prueba
 enable
 index 1
 type employee
 essid prueba
 wpa-passphrase d7b2063ab546b5314eff8d59140e79ab981b5a9d9f1bc06e
 opmode wpa2-psk-aes
 max-authentication-failures 0
 vlan 501
 rf-band all
 captive-portal disable
 dtim-period 1
 inactivity-timeout 86400
 broadcast-filter arp
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64
 dot11r

wlan ssid-profile VIPTrabajo
 enable
 index 2
 type guest
 essid "WiFi Asesores"
 opmode opensystem
 max-authentication-failures 0
 vlan 190
 auth-server trabajoradius
 rf-band all
 captive-portal internal
 called-station-id include-ssid delimiter :
 dtim-period 1
 inactivity-timeout 86400
 broadcast-filter arp
 deny-inter-user-bridging
 multicast-rate-optimization
 blacklist
 dynamic-multicast-optimization
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64

wlan ssid-profile MinPyT
 enable
 index 3
 type employee
 essid "WiFi MPyT"
 opmode wpa2-aes
 max-authentication-failures 0
 vlan 160
 auth-server trabajoradius
 rf-band all
 captive-portal disable
 called-station-id include-ssid delimiter :
 dtim-period 1
 inactivity-timeout 86400
 broadcast-filter arp
 multicast-rate-optimization
 dynamic-multicast-optimization
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64

enet-vlan 7
auth-survivability cache-time-out 24



wlan ldap-server it
 ip 172.16.1.61
 port 389
 admin-dn "CN=CiscoLDAP,OU=Cuentas de Servicios - OU Oculta a los usuarios,OU=Recursos de MTEySS,DC=ministerio,DC=trabajo,DC=gov,DC=ar"
 admin-password 51765cdd46e83f3077fc900ef40232e4ed5caabf273cefb1a43b6228bef164ce68b0f985311bfff8
 base-dn "OU=Administradores,OU=Recursos de MTEySS,DC=ministerio,DC=trabajo,DC=gov,DC=ar"
 filter (objectclass=*)
 key-attribute sAMAccountName

dpi

url-visibility

wlan auth-server pf
 ip 172.16.0.34
 port 1812
 acctport 1813
 key 44a4cfa04f97d19558a861db6e07a4d7
 nas-ip 192.168.7.236
 rfc5997 auth-only
 rfc3576
 cppm-rfc3576-port 5999

wlan auth-server trabajoradius
 ip 172.16.0.39
 port 1812
 acctport 1813
 key 2ff60b629945692c0282f1eeb48c24600f73562d8315f31a

wlan auth-server SkyFiiRADIUS
 ip 52.52.68.90
 port 1812
 acctport 1813
 key 4cecb3ed8a89bc0a9dab56e2f0a479a3
 rfc5997

wlan auth-server SkyfiiRADIUSbkp
 ip 52.8.61.119
 port 1812
 acctport 1813
 key 7c5df045f992a274ad5fddab2048cb78
 rfc5997

wlan captive-portal
 background-color 16120819
 banner-color 4108287
 redirect-url "http://www.trabajo.gob.ar"
 banner-text "Bienvenidos"
 terms-of-use " "
 use-policy "Para ingresar utilice sus credenciales de red de trabajo"
 authenticated

wlan external-captive-portal
 server https://guestwifi-us.skyfii.com
 port 443
 url "/welcome/iap/aruba"
 auth-text ""
 https

wlan external-captive-portal Skifii-Guest-Wifi
 server guestwifi-us.skyfii.com
 port 443
 url "/welcome/aruba/iap"
 auth-text ""
 https


wlan walled-garden
 white-list "skyfii.com"
 white-list "securelogin.arubanetworks.com**"
 white-list "52.62.73.96"
 white-list "54.64.33.144"

blacklist-time 3600
auth-failure-blacklist-time 3600



ids
 wireless-containment none


wired-port-profile wired-SetMeUp
 switchport-mode access
 allowed-vlan all
 native-vlan guest
 no shutdown
 access-rule-name wired-SetMeUp
 speed auto
 duplex auto
 no poe
 type guest
 captive-portal disable
 no dot1x

wired-port-profile default_wired_port_profile
 switchport-mode trunk
 allowed-vlan all
 native-vlan 169
 shutdown
 access-rule-name default_wired_port_profile
 speed auto
 duplex full
 no poe
 type employee
 auth-server InternalServer
 captive-portal disable
 no dot1x

wired-port-profile Trunk
 switchport-mode trunk
 allowed-vlan 93,192,169,190,501
 native-vlan 7
 no shutdown
 access-rule-name Trunk
 speed auto
 duplex auto
 poe
 type employee
 auth-server InternalServer
 captive-portal disable
 no dot1x


enet0-port-profile Trunk

uplink
 preemption
 enforce none
 failover-internet-pkt-lost-cnt 10
 failover-internet-pkt-send-freq 30
 failover-vpn-timeout 180

l3-mobility
 home-agent-load-balancing
 virtual-controller 192.168.7.196
 virtual-controller 192.168.7.78
 subnet 192.168.192.64 255.255.255.192 505 192.168.7.78
 subnet 192.168.191.0 255.255.255.0 501 192.168.7.196

airgroup
 disable

airgroupservice airplay
 disable
 description AirPlay

airgroupservice airprint
 disable
 description AirPrint