Cisco 877 as access point and DSL router - 2 subnets

I have been using an 877 to provide DSL access and wireless access point from two separate wired subnets. The idea is that traffic from one subnet will be routed to the DSL connection. The other subnet provides a bridged connection to wireless clients. Both subnets being isolated from each other. In the former case the router acts as DHCP server, whilst in the latter case a separate DHCP server is used. Despite all apparently working, recent introduction of a wireless client did not work and seemed to be acquring a DHCP lease from the router rather than the external DHCP server. It seems that broadcast traffic from the router DHCP server was traversing to the wrong interfaces, despite (I hope) only the wireless and the second wired subnet being in the bridge group.
I would be grateful if anyone can throw any light on this, the salient parts of my config are enclosed below. I have anonymised the public addreses using q1.q2.q3 therein. Many thanks.
dot11 ssid MYSSID
   authentication open eap eap_methods
   authentication network-eap eap_methods
   authentication key-management wpa
   guest-mode
no ip source-route
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.10.10.1
ip dhcp excluded-address q1.q2.q3.15 q1.q2.q3.254
ip dhcp excluded-address q1.q2.q3.1 q1.q2.q3.8
ip dhcp pool sdm-pool1
   import all
   network q1.q2.q3.0 255.255.255.0
   domain-name MyDomain
   dns-server x.y.z.1 x.y.z.2
   default-router q1.q2.q3.3
bridge irb
interface FastEthernet0
interface FastEthernet1
interface FastEthernet2
switchport access vlan 10
spanning-tree portfast
interface FastEthernet3
switchport access vlan 10
spanning-tree portfast
interface Dot11Radio0
no ip address
encryption mode ciphers tkip
ssid mySSID
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
bridge-group 10
bridge-group 10 subscriber-loop-control
bridge-group 10 spanning-disabled
bridge-group 10 block-unknown-source
no bridge-group 10 source-learning
no bridge-group 10 unicast-flooding
interface Vlan1
description $ES_LAN$
ip address q1.q2.q3.3 255.255.255.0
ip access-group 102 in
ip nat inside
ip virtual-reassembly
interface Vlan10
no ip address
bridge-group 10
interface BVI10
ip address 192.168.253.251 255.255.255.0
bridge 10 protocol ieee
bridge 10 route ip

If the Router is not the DHCP server, you'll want to put an ip helper-address under teh BVI 10 and point to the correct DHCP server
HTH,
Steve
Please remember to rate useful posts, and mark questions as answered

Similar Messages

Multiple Cisco Aironet 1131AG access points and same SSID?

We have multiple Cisco Aironet 1131AG devices, all wired on one Cisco L2 switch(2560) who is connected to L3 switch (3550). We assigned one VLAN for access point in L3 switch who acts as vtp server (L2 switch is vtp client). All ap's will have static ip address and all will have same SSID and no security and they will be using multiple channels (ex. 1,6,11). They will operate in 3 floor building for roaming wireless client. We won't using any wireless controller.
So my question is this: How to configure APs-all the same with different ip's, can we use L3 switch to create dhcp server for access points VLAN (pool for clients, and the rest for static ip for ap's)? Can one of the ap's be WDS and in the same time local radius server with users without Cisco Secure ACS or similar controller or I didn't understand this quite well :-). I followed guide http://www.cisco.com/en/US/docs/wireless/access_point/12.3_2_JA/configuration/guide/s32roamg.html for WDS where the part abou Cisco ACS is a problem, so I can use same ap as Local Authenticator as in guide http://www.cisco.com/en/US/docs/wireless/access_point/12.3_4_JA/configuration/guide/s34local.html#wp1035723.
Many thanks...

Well, just so you know, WDS and local RADIUS authentication is only needed if you're using authentication on your wireless connection. You say you're not planning to use security, so this isn't necessary. However, I'd highly recommend at least using a simple WPA2-PSK to lock down your connection, otherwise you might end up giving free Internet access at best, and at worst you might be giving access to company PCs and servers. If you want to further use an 802.1x or WPA authentication method, then yes, you can use an AP as a RADIUS server and WDS to improve authenticated roaming, but this is far more limited than using a Cisco ACS.
As for your other questions, yes, your APs can all be configured the same except for at least three parameters: IP address, channel, and hostname. Configure your static IP addresses on the AP's BVI1 interface. Don't place it on the Radio or Ethernet interfaces, because if either of these interfaces goes down you'll lose the ability to configure the AP, so it's best to use the BVI1 interface.
And yes, configuring a DHCP scope for your clients on your L3 switch is a good design, or you could also use your DHCP server on a different subnet by using the ip helper-address command on the L3 interface. I hope this helps! Let me know if you need help configuring any of this.
Merry Christmas!
Jeff

Cisco 1142 Wireless access point intermittently will not authenticate

Hi all,
We have a Cisco 1142 standalone access point, and from time to time I will come into the office and it will not authenticate any users to either our guest or corporate networks. I then have to go in and reboot the access point. After that, it begins to work. Any advice? Here's my configuration below:
Current configuration : 6450 bytes
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname cisco-chiap01
logging monitor errors
enable secret 5 $1$fsD8$CU42/3/Up5AAlL4hQWvvg0
aaa new-model
aaa group server radius rad_eap
server 172.17.16.12 auth-port 1645 acct-port 1646
server 172.17.21.10 auth-port 1812 acct-port 1813
aaa group server radius rad_mac
aaa group server radius rad_acct
aaa group server radius rad_admin
aaa group server tacacs+ tac_admin
aaa group server radius rad_pmip
aaa group server radius dummy
server 172.17.21.10 auth-port 1812 acct-port 1813
aaa group server radius rad_eap2
server 172.17.16.12 auth-port 1645 acct-port 1646
server 172.17.21.10 auth-port 1812 acct-port 1813
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authentication login eap_methods2 group rad_eap2
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
login on-failure log
login on-success log
dot11 syslog
dot11 vlan-name Admin vlan 100
dot11 vlan-name DevNetwork vlan 20
dot11 vlan-name Guest vlan 150
dot11 vlan-name Network vlan 16
dot11 ssid DevNetwork
vlan 20
authentication open eap eap_methods2
authentication network-eap eap_methods2
authentication key-management wpa version 2
dot11 ssid Guest
vlan 150
authentication open
authentication key-management wpa version 2
guest-mode
mbssid guest-mode
wpa-psk ascii 7 142407060101380B013A3A2670435642
information-element ssidl advertisement
dot11 ssid Network
vlan 16
authentication open eap eap_methods2
authentication network-eap eap_methods2
authentication key-management wpa version 2
username monkeyman privilege 15 secret 5 $1$ZZ7C$rqimu2FNONdfeacMNGAD/.
bridge irb
interface Dot11Radio0
no ip address
ip helper-address 172.17.19.10
no ip route-cache
encryption mode ciphers aes-ccm
encryption vlan 16 mode ciphers aes-ccm
encryption vlan 150 mode ciphers aes-ccm
encryption vlan 20 mode ciphers aes-ccm
ssid DevNetwork
ssid Guest
ssid Network
antenna gain 0
parent timeout 120
speed 5.5 11.0 basic-6.0 9.0 12.0 36.0 48.0 54.0
packet retries 128 drop-packet
channel 2462
station-role root
rts threshold 512
rts retries 128
interface Dot11Radio0.11
encapsulation dot1Q 11
no ip route-cache
interface Dot11Radio0.16
encapsulation dot1Q 16 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio0.20
encapsulation dot1Q 20
no ip route-cache
bridge-group 20
bridge-group 20 subscriber-loop-control
bridge-group 20 block-unknown-source
no bridge-group 20 source-learning
no bridge-group 20 unicast-flooding
bridge-group 20 spanning-disabled
interface Dot11Radio0.150
encapsulation dot1Q 150
no ip route-cache
bridge-group 150
bridge-group 150 subscriber-loop-control
bridge-group 150 block-unknown-source
no bridge-group 150 source-learning
no bridge-group 150 unicast-flooding
bridge-group 150 spanning-disabled
interface Dot11Radio1
no ip address
ip helper-address 172.17.19.10
no ip route-cache
encryption vlan 16 mode ciphers aes-ccm
encryption vlan 150 mode ciphers aes-ccm
encryption vlan 20 mode ciphers aes-ccm
ssid DevNetwork
ssid Guest
ssid Network
antenna gain 0
traffic-metrics aggregate-report
dfs band 3 block
mbssid
parent timeout 120
speed 6.0 12.0 basic-24.0 36.0 48.0 54.0
channel width 40-above
channel dfs
station-role root access-point
interface Dot11Radio1.11
encapsulation dot1Q 11
no ip route-cache
interface Dot11Radio1.16
encapsulation dot1Q 16 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface Dot11Radio1.20
encapsulation dot1Q 20
no ip route-cache
bridge-group 20
bridge-group 20 subscriber-loop-control
bridge-group 20 block-unknown-source
no bridge-group 20 source-learning
no bridge-group 20 unicast-flooding
bridge-group 20 spanning-disabled
interface Dot11Radio1.150
encapsulation dot1Q 150
no ip route-cache
bridge-group 150
bridge-group 150 subscriber-loop-control
bridge-group 150 block-unknown-source
no bridge-group 150 source-learning
no bridge-group 150 unicast-flooding
bridge-group 150 spanning-disabled
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
no keepalive
interface GigabitEthernet0.11
encapsulation dot1Q 11
no ip route-cache
interface GigabitEthernet0.16
encapsulation dot1Q 16 native
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
interface GigabitEthernet0.20
encapsulation dot1Q 20
no ip route-cache
bridge-group 20
no bridge-group 20 source-learning
bridge-group 20 spanning-disabled
interface GigabitEthernet0.100
encapsulation dot1Q 100
ip address 192.168.100.3 255.255.255.0
no ip route-cache
bridge-group 100
no bridge-group 100 source-learning
bridge-group 100 spanning-disabled
interface GigabitEthernet0.150
encapsulation dot1Q 150
no ip route-cache
bridge-group 150
no bridge-group 150 source-learning
bridge-group 150 spanning-disabled
interface BVI1
ip address 172.17.16.251 255.255.255.0
no ip route-cache
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface GigabitEthernet0
access-list 1 permit 172.17.16.1
access-list 1 remark Admin network access
access-list 1 permit 192.168.100.0 0.0.0.255
radius-server attribute 32 include-in-access-req format %h
radius-server host 172.17.21.10 auth-port 1812 acct-port 1813 key 7 047958071C3561410D4A44
radius-server host 172.17.16.12 auth-port 1645 acct-port 1646 key 7 08045E471A48574446
radius-server host 172.17.21.10 auth-port 1645 acct-port 1646 key 7 1320051B185D56797F
radius-server timeout 15
radius-server vsa send accounting
bridge 1 route ip
line con 0
line vty 0 4
access-class 1 in
end

When the issue occurs does that affect both 2.4GHz & 5GHz devices ? I would see which band operating devices affected.
I noticed you have set CH11 under Radio 0 statically. I would prefer to configure it as below so AP can change the channel depend on the environment.
int d0
channel least-congested
HTH
Rasika
**** Pls rate all useful responses ****

IPhone4 and Cisco Aironet 1141 access point - fail using WPAv2 Personal

I cannot get my iPhone4 (latest s/w) to connect to a Cisco Aironet 1141 access point if I specify WPAv2 Personal. It is a single access point without radius etc. I have no problems connecting using "no security", WEP or WPAv1. Is there a problem with the iPhone4 implementation of WPA2 as all my other PCs connect just fine on WPAv2?
With the Aironet 1141 I can switch security between WPAv1 & WPAv2 while keeping all other settings identical. Thus I can clearly demonstrate how the iPhone4 connects when both devices are set to WPAv1 yet will fail to connect when I switch both to WPAv2. As I have said, all other PCs I have connect via WPAv2 without any issues.

I cannot get my iPhone4 (latest s/w) to connect to a Cisco Aironet 1141 access point if I specify WPAv2 Personal. It is a single access point without radius etc. I have no problems connecting using "no security", WEP or WPAv1. Is there a problem with the iPhone4 implementation of WPA2 as all my other PCs connect just fine on WPAv2?
With the Aironet 1141 I can switch security between WPAv1 & WPAv2 while keeping all other settings identical. Thus I can clearly demonstrate how the iPhone4 connects when both devices are set to WPAv1 yet will fail to connect when I switch both to WPAv2. As I have said, all other PCs I have connect via WPAv2 without any issues.

IOS 6, Netgear access point and Internet

Hi,
I’ve reached a point where I’m not entirely sure what to do next.
Here are some quick details (all are on most recent firmware unless stated):
Router: Draytek Vigor2830n
Access Point: Netgear WG102
Devices: iPhone 4, iPhone 5, iPad 2 and two iPad 2’s for comparison on iOS 5.
So, all devices running iOS 6.1.3/4 will connect to the Netgear access point just fine, can browse the LAN / stream media from network shares but internet access seems to be 'delayed' and can take anywhere between a minute to 20 minutes to connect (I give up after this). In comparison both the iPad 2’s running iOS 5 will gain internet access immediately after connecting to the access point.
On the other hand, when connecting to the routers wireless on all devices it works flawlessly and internet connection is 'instant'.
Given the problems that Netgear wifi has had with iOS 6, which were supposedly ‘fixed’ in iOS 6.1, I’m not sure what to do. It’s definitely a software problem, and could well be something to do with the router (along with connecting to the access point and iOS 6), but I’m not sure what to start changing first. iOS 5 works fine, so what has changed in iOS 6 to break it?
Its not a security issue like before 6.1 and not being able to connect to the access point at all.
Basically:
- I either need to figure what in iOS 6 is causing this ‘delay’ and how to fix it
-Give up on the access point and buy a new one (seems a bit extreme given that every other devices works fine – iOS 5, blackberry, laptops etc).
-Wait for iOS 7, hopefully in the next couple of weeks and see if it fixes it, though I can find little information on this issue as it is, and nothing to suggest iOS 7 might help. Though if iOS 5 is fine, iOS 6 broke it and 6.1 slightly fixed it, maybe iOS 7 will cure it? Doubt it…but worth waiting a few days.
Anyone got any suggestions? I have been through all the usual (HTTP proxy, forget this network, reset network settings), nothing makes it work flawlessly like iOS 5 and the issue is the same on a wide spread of devices running iOS 6.

Dont know my routerand access point works fine. Try http://support.apple.com/kb/HT4199 and make sure your setting are correct.

Silly doubt abt access-points and bridges

hi all i have read cisco doc wherein clients connecting to access-points and also where the cisco access-point is working like a bridge and still clients can connect to it .
then any specific reason why people generally connect clients to access-points.
i mean is there any benefit of either method over the other.
any help and guidance would be really helpful.
regards
sushil

In short, it is preferred to have users connect to access points.... 99% of the time. You can use a wireless bridge (that is associated to an AP) that is connected to a switch/hub to supply network connectivity to wired users off the switch/hub. There are also access points that can be used as a bridge for building point to point connectivity.
Look at the home users with wireless.... it allows then to move from place to place (as long as there is coverage) without having to be wired in.

Use N95 as access point and get laptop inet throug...

Is it possible to use the N95 as an (WIFI) access point and use a laptop, a psp, an ipod touch to access the internet through 3G or even Turbo 3G?
That would be really really cool!
Regards
Raptor

I dont think it is as would have to be connected through a router to a phone line anyway. My psp doesn't even detect my N95. You would have to use it as a bluetooth modem and 3g.
Its not who i am underneath. But what i do that defines me.
You are here for a reason Superman.
"Come to me son of Jor-EL. KNEEL BEFORE ZOD"

Cisco AIR-CAP3602I access point conversion

Hello Group,
I have a 3602i access point and have been looking to see if it was possible to load a Mesh AP image on the AP?

Hello,
Agree with George. You can set the ap to mesh by changing its mode to bridge. you can change the mode from gui:
Wireless -> your ap -> ap mode.
HTH
Amjad
Sent from Cisco Technical Support iPad App

Configuring Cisco Aironet 1100 Access Point. Please help!

Hi all,
I have dozens of Cisco Aironet 1100 access points, each is managing its own wi-fi with DHCP.
I had to disable dhcp on them because they are on a wired subnet where I am using the static IPs and don't want my wired clients to get DHCP addresses, nor someone to be able to plug the wire into own laptop and get on the network.
It's been working fine with one exception - I need to be able to ping my access points from the central site, and I can't.
What IOS command would enable ICMP echo on my access points in this case?
Please help!

Hi all,
I have dozens of Cisco Aironet 1100 access points, each is managing its own wi-fi with DHCP.
I had to disable dhcp on them because they are on a wired subnet where I am using the static IPs and don't want my wired clients to get DHCP addresses, nor someone to be able to plug the wire into own laptop and get on the network.
It's been working fine with one exception - I need to be able to ping my access points from the central site, and I can't.
What IOS command would enable ICMP echo on my access points in this case?
Please help!

Connection between lightweight access point and switch?

Hello everybody,
I am a bit confused about cisco 1000 series access point connection. On wireless lan controller and lightweight access point basic configuration example document id 69719 (http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a0080665cdf.shtml), I understood the access point has two vlans associated with (vlan 3 and 4). Am I correct?
Why is connection between access point and catalyst port just access port rather 802.1q trunk? How vlan traffic can traverse from the access point to controller?
Please advice.
Many thanks,
Nitass

Nitass,
The AP itself does not need to be a trunked port, but the uplink to the controller does. When using a Lightweight enviroment, all the traffic passes thru an encrypted LWAPP tunnel from the AP to the controller, and then gets sent out the correct VLAN interface on the controller.

TS1702 Maps program does not work. In standard it only shows a grid. If I ask for a route it shows start and end point and three route boxes but nothing else. It does show directions. If I switch to hybrid it shows to routes but no roads. Background is a

Maps program does not work. In standard it only shows a grid. If I ask for a route it shows start and end point and three route boxes but nothing else. It does show directions. If I switch to hybrid it shows to routes but no roads. Background is a blur.

Do you have a question? This is a user to user help forum. Apple is not here only other users like yourself. You don't report problems to Apple here.
By the way, it might help if you indicated where you are located.
To complain to Apple use http://www.apple.com/feedback/ipad.html

WRT54G ver. 6 Connected to access point and internet, but cannot access the web

I can connect to the access point and it shows that I an connected to the internet. However when I open a bowser it says page cannot be displayed! Signal is very good to excellent. Also, I have been using it all day and it was working fine, until I shutdown. When I booted back up it stopped working. The internet is working! I have XBOX Live working right now. Just not the computer. Any Help would be appreciated.
WRT54G ver. 6
Message Edited by SJohnson4 on 12-01-200607:35 PM

Hi... it seems that your Wireless adapter on does get a IP address or DNS no after reboot. Try assigning a Static IP address and DNS on the Wireless Adapter. Also try to update the drivers for that wireless adapter.

Trying to get home shaing working on apple tv using Cisco Access points and a Cisco WLC 5508 with 7.2.110 code. I can get devices working individually but they never see each other. I can ping the apple tv from my laptop and ipad.

Trying to get home sharing working on a corporate wireless network. Cisco wireless.
WLC5508 controller
Cisco 3502 access points
All apple devices on same WLAN - security WPA2-PSK
ITunes account up to date
All devices laterst software.
Can ping apll tv from laptop
can ping apple tv from ipad
Can ping ipad from laptop
can ping laptop from ipad.
Apple tv never sees any other device.
Any ideas?

Fascinating just reading about your setup. I have a WRT350N and have noticed that it will drop its speed, sometimes down to 1Mbps. It seems to do so at about the same time every day, but usually comes back to speed in about 5 minutes. In my experience, the Apple TV will disconnect if the speed falls this low. Try monitoring the Linksys with Netstumbler, Vistumbler, or just in the Windows Network utility.
Check the "lease obtained" and "lease expired" times for your router to see if that is when the network fails. I've just finished reading an angry thread over at the Linksys forum about the WRT330N where someone mentioned that the router wasn't renewing its lease.
"I cannot set it run off automatic DHCP from the WRT330N, the router will not assign it an IP every time the lease expires, causing me to have to manually set an IP on the Print server. That's annoying. Having the router drop IP's to individual machines after 12-48 hours...very annoying."
http://forums.linksys.com/linksys/board/message?board.id=Wireless_Routers&thread .id=67412
If that is the problem, then I would consider setting up a Static IP address for your Apple TV. You can do that through the user interface -> Settings -> Network -> Configure ... (Quite intuitive as you only have change IP address and the subsequent details remain the same.)
My router assigns IP Addresses in the ranges of 192.168.1.100 ->149. The idea here is to choose an address outside of that range but is not greater than 192.168.1.253 (and should not end in the number 1). You shouldn't have to change the linksys router as long as 50 clients are assigned in that range. You'll have to figure that out by accessing your router webpage at browser address 192.168.1.1 -> the default password is "admin" (without the quotes).
Good luck.

How to add a second router as access point and wifi signal extender

Previously I had 2 linksys routers and was able to configure them as one in separate areas of my house. I think it is called cascading. The 2nd router acted as an ethernet switch with 4 extra ports and it provided a wifi signal to areas of my house that previously had a weak signal when I used only one router.
I have since switched to an Airport Extreme as my main router. I can't seem to get the same configuration with the linksys router, it is Model E1000 and has an "N" signal. The Linksys E1000 I think is the newer model of the old WRT54G Linksys. I can't get it configured to work. I have searched high and low on the internet and can't find anything simple enough for a novice to understand. I did read something that I may have to assign a "DHCP Reservation" on the Apple Extreme. I couldn't figure that out.
Can somebody please offer some guidance on how to get this to work?
Thanks

You have two routers producing two networks with the same name, so they will show up as two networks on any type of scan by a wireless utility. This is normal.
If you had used two Linksys devices, they would probably show up as one network, not two. Linksys has a feature that allows this to occur, but this is not true of Apple devices.
As long as the wireless network name, wireless security and password match up between the two routers, the two networks will behave as if they were one. As computers change location, they will automatically connect to the wireless access point with the strongest signal.

Cisco autonomous access points and WCS

Hi, I'm trying to add my autonomous access points to WCS which I have done but I'm not getting any performance data or errors etc.
Does anyone know if WCS support autonomous access points or do I have to use WLSE to get this info
Thanks

Greetings the WLSE will be needed to manage autonomous access points. The WCS application is geared towards LWAPP and Controller based implementations.
For a comparison please see the following document.
http://www.cisco.com/en/US/products/hw/wireless/products_category_buyers_guide.html#http://www.cisco.com/en/US/products/hw/wireless/products_category_buyers_guide.html?linkpos=4#number_4
Regards

Cisco 877 as access point and DSL router - 2 subnets

Similar Messages

Maybe you are looking for