Question re: BR1310 in Workgroup Bridge Mode

When a BR1310 is in Workgroup bridge mode, it can provide a wired connection from the BR to a device. Can it also service wireless users?

If I understand your question you need more equipment to provide wireless connectivity from the location of the WGB. Add a switch/hub to the output of the BR1310 and an Acess Point to one of the hubs ports.

Similar Messages

Using the 1262 AP in Workgroup Bridge Mode

Client has a building that is located 300Ft apart and would like to provide IP communications for 3-4 IP hadsets back to an IP PBX. They do not want to dig up the parking lot so we proposed using a wireless bridge. I noticed that Cisco discontinue the 1300 and 1400 Wireless Bridge. Can I use a 1262 with external antenna in Workgroup Bridge mode to perfom this functions? I will put a Layer 3 switch on both ends to route traffice (3560C-8). Should I use the Yagi antenna's for outdoor use? Thanks!

You could go WGB, but root/non-root might work better. This will allows you to pass multiple VLAN across the link.
This is a bit old, but it' the Bridge Range utility
http://www.cisco.com/en/US/prod/collateral/wireless/ps5678/ps458/prod_technical_reference09186a00800a912a.xls
HTH,
Steve
Please remember to rate useful posts, and mark questions as answered

How to setup LAPAC1750-PRO with LAPAC1750 Workgroup Bridge Mode as WiFi Extender

I've got following devices:
1 LRT224 Dual WAN Gigabit VPN Router (Load Balancing)
2 LAPAC1750-PRO Access Points
6 LAPAC1750 Access Points
I'm supposed to make a Cluster between 2 LAPAC1750-PRO and then connect the 6 LAPAC1750 using Workgroup Bridge Mode, but after purchasing and while configuring, I found the strage thing that:
If I need to setup a Workgroup Bridge Mode, the clustering will not be available (so I need to modify the changes on either PRO APs whenever I need to perform some) and the Bridge Mode needs to be disable if Clustering is ON or vice versa.
Spoiler (Highlight to read)
+--- The Configuration ---+
I've made 2 subnets:
192.168.1.x (Existing)
192.168.10.x (New)
and configured 4 APs on each (1 PRO and 3 Normal using Trunking between 2 HP 1910 24 Switches) and then again found some strange thing that:
Only 1 Normal AP can be connected to PRO in a Workgroup Bridge Mode, and vice versa.
+--- The Configuration ---+I've made 2 subnets:192.168.1.x (Existing)192.168.10.x (New)and configured 4 APs on each (1 PRO and 3 Normal using Trunking between 2 HP 1910 24 Switches) and then again found some strange thing that: Only 1 Normal AP can be connected to PRO in a Workgroup Bridge Mode, and vice versa.
+--- The Problem ---+
--- Please correct me if I'm wrong
It supposed to extend the Wireless Range, therefore I need to do the following:
PRO AP needs to connect to the AP 1 of and the AP 1 then connects to AP 2 and so on in Workgroup Bridge Mode ...
OR
All the APs needs to connect to the PRO one by registering one by one in Workgroup Bridge Mode
Thanx in Advance

Thanx! The information is very helpful.

1602 AP - Workgroup Bridge Cannot Associate to Parent AP

Hi All,
For a few weeks now, I have been trying to connect a Cisco 1602 standalone AP to our unified wireless network as a workgroup bridge. Eventually this AP is to be moved to another wireless network where I will need it to run in universal workgroup bridge mode (for non Cisco wireless networks), so I just want to get this working in the office before I take it elsewhere and try to get that to work, as the configuration will be similar.
So far I've been unable to get this 1602 AP to associate to our network. The particular SSID I'm trying to set up is a BYO style SSID, normally if you connect a device you provide your Active Directory username / password and your laptop / phone / whatever connects. I know the username is fine because if I use it on another device it's not a problem.
The AP keeps repeating this message: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Associating. Cisco.com tells me that this is to do with MFP, however I've changed a number of MFP settings in the SSID and this seems to have made no difference.
I'm thinking this is a problem with authentication or association. I have a question, why do I need to input Radius server information into the config (eap_methods)? When you connect a regular device to this SSID it doesn't require any Radius server settings in order to connect, I don't understand why the AP needs these settings. Also, when authenticating to AD, do you need to include the domain name as part of the username?
Wireless isn't my strong point unfortunately. Is anyone able to help with this? Config and log is below. Many thanks.
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname WGB-AP
logging buffered 10000
logging rate-limit console 9
enable secret 5 xxxx
aaa new-model
aaa user profile userprofilename
aaa group server radius rad_eap
aaa group server radius rad_mac
aaa group server radius rad_acct
aaa group server radius rad_admin
aaa group server tacacs+ tac_admin
aaa group server radius rad_pmip
aaa group server radius dummy
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
no ip routing
no ip cef
dot11 syslog
dot11 ssid BYO
authentication open eap eap_methods
authentication shared eap eap_methods
authentication network-eap eap_methods
authentication key-management wpa version 2
dot1x credentials MyCreds
dot1x eap profile EAPTLS
infrastructure-ssid
ids mfp client optional
eap profile EAPTLS
method mschapv2
method peap
crypto pki token default removal timeout 0
crypto pki trustpoint TP-self-signed-88743315
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-88743315
revocation-check none
rsakeypair TP-self-signed-88743315
crypto pki trustpoint WGB-PEAP
enrollment terminal
subject-name CN=username
revocation-check none
rsakeypair manual-keys 1024
crypto pki certificate chain TP-self-signed-88743315
certificate self-signed 01
30820227 30820190 A0030201 02020101 300D0609 2A864886 F70D0101 05050030
2F312D30 2B060355 04031324 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 38383734 33333135 301E170D 39333033 30313030 30383234
5A170D32 30303130 31303030 3030305A 302F312D 302B0603 55040313 24494F53
2D53656C 662D5369 676E6564 2D436572 74696669 63617465 2D383837 34333331
3530819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281 8100BB10
F5361E52 A573FE8A 247142AD CF53D762 38F7BB42 7E723B2B 5C78100E 7F312442
3BE63A8B 7E826758 3F2914D0 4BBC93A6 CCACA795 927514E7 74561589 444D03BA
C20B80D8 85E52A18 C3B287BF 4A1EEF83 B43DD673 12BF075F 7CA038C0 C31F1FB4
F75C3F86 C09DC703 FB05676B 16B86754 F0F11D4D 36B61F81 DF15C02A 9C410203
010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603 551D2304
18301680 14999B3B 7F4B10FA B95CC90B D7218636 39280AFE 4E301D06 03551D0E
04160414 999B3B7F 4B10FAB9 5CC90BD7 21863639 280AFE4E 300D0609 2A864886
F70D0101 05050003 81810076 27E215C4 C105C66D 15124645 D3F4A538 F977A95F
7AF0FF05 648D41A4 A796F9CB CC6327FF 726DA1D6 290CD438 C2111DF8 208B92B5
63B09FEC 1CA334F7 A4607E71 18EBCB44 0A175BEE 30689849 B4D9222E 7EB1C1DB
F36BDDD3 3F5514A6 8A006A8A A113A44D 7337B6D8 7860AA25 EBAD5588 8543DF88
9E6A3D62 6E875372 277B57
quit
crypto pki certificate chain WGB-PEAP
dot1x credentials MyCreds
username DOMAIN\AD-USER
password AD Password
username Cisco password 7 00271A150754
username DOMAIN\AD-USER
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption mode ciphers aes-ccm
ssid BYO
antenna gain 0
stbc
beamform ofdm
station-role workgroup-bridge
bridge-group 1
bridge-group 1 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
encryption mode ciphers aes-ccm tkip
ssid BYO
antenna gain 0
no dfs band block
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
interface BVI1
no ip address
no ip route-cache
ip forward-protocol nd
no ip http server
ip http authentication local
ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
radius-server attribute 32 include-in-access-req format %h
radius-server host xxxx auth-port 1812 key 7 xxxx
radius-server vsa send accounting
bridge 1 route ip
line con 0
logging synchronous
line vty 0 4
transport input all
end
Jan 5 14:34:30.636: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Associating
Jan 5 14:36:23.730: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Associating
Jan 5 14:36:42.730: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Associating
Jan 5 14:38:19.833: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Associating
Jan 5 14:39:33.901: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Associating
Jan 5 14:40:49.948: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Associating
Jan 5 14:42:10.123: %SYS-5-CONFIG_I: Configured from console by console
Jan 5 14:42:42.031: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: No Response
Jan 5 14:42:46.031: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Associating
Jan 5 14:43:06.058: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Associating
Jan 5 14:45:18.173: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associate: Associating

With PEAP there is a certificate being used on the radius server for securing the first phase (outer tunnel). In this scenario the access-point acts like a dot1x client, so like any other client it has to validate the certificate the radius server uses. Therefor the root certificate (and intermediates, if being used) needs to be installed on the access-point.
I never configured an WGB in this way, so I fired on my lab to see if I could get it to work. Sadly I did not manage to get it to work properly, I'm running into "EAP session timed out" messages in ACS (my radius server). I did also ran into the MFP issue, but as long as you configure MFP as optional on the network side, it should work. Because of the CCIE exam, I'm running old AirOS software on the WLC and also the software on the access-point I tested this configuration on (2600) is not that new. So it could be that I ran into a bug testing this, so I would advise you to run the latest software on your 1600. There are WGB related bugs fixed not so long ago. This configuration is supported since IOS 15.2.2(JA) and higher.
If I look at your configuration you still need to actually install the certificate, the trustpoint is empty. Besides that the following configuration changes needs to be made:
eap profile EAPTLS
no method mschapv2
method peap
dot11 ssid BYO
authentication open eap PEAP
   no authentication shared eap eap_methods
authentication network-eap PEAP
authentication key-management wpa version 2
dot1x credentials MyCreds
dot1x eap profile EAPTLS
   no infrastructure-ssid
   no ids mfp client optional
For more information look at this document.

Bridge mode of controller base ap

I have testes two standalone ap is able to connect thorugh root-bridge mode and non-bridge mode, but when i try to the non-root bridge ap to controller base ap with bridge mode enable is fail, is there anyone can provide some suggestion?

Ras good reply my friend +5.
Chun -- Correct if you put it into workgroup bridge mode it will connect. You mentioned you were in root / non-root. It will not if thats the case.
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Access Point in bridging mode.

Hi,
I have tow APs (AP1242AG) that have the two radios (the 802.11g and the 802.11a radios) configured in bridge mode.
Can I do this?
The problem is that one of them put the radio interface (802.11a radio interface in âresetâ. And there is no connectivity between the two routers.
Can you help me?
Please.
Thanks in advance,
Rui CapÃ£o

Follow the configuration guide for the Workgroup Bridge Mode it may help you
http://www.cisco.com/en/US/docs/wireless/access_point/12.3_7_JA/configuration/guide/s37hot.html#wp1041408

Routed or bridged mode + licensing question

Hi Cisco ACE gurus,
I have the following questions and I would be grateful if anyone could answer them.
1) As we know the basic license for ACE limits its throughput to 4Gbps. What does it mean? Does it mean that only load balanced traffic is limited (policed) to 4Gbps? Or any other traffic passing through ACE is limited to 4Gbps (from what I know ACE is a cef720 linecard having 20Gbps to a switch fabric)?
My question comes from the following scenario. Let's say ACE is deployed in routed mode and it has 1 client vlan and 2 server vlans. There are VIPs, serverfarms, rservers defined etc.... Now there is a need for a rserver from vlan1 to communicate with a rserver from vlan2 (directly and not through a VIP). In this scenario def gateway of both servers points to ACE (ACE is doing inter-vlan routing).
So in this case in order to allow for that communication I would need to create ACLs and apply them to ACE interfaces.
Does it mean that the traffic would be limited to only 4Gbps?
2) let's say I have 2 DC (2 different geo locations). ACE is located only in one of them. Real servers are dispersed in both of them. ACE is deployed in routed mode. Is it possible to configure ACE in such a scenario (to server VIPs for clients when rservers are in 2 different DC)?
My assumption is that it is possible and in order to do that I would have to use NAT (and source NAT client traffic) so that traffic sent from client to a VIP could be src natted and go to the other DC (through client vlan), reach the rsevers in the other DC and come back.
Is it possible to also do that while ACE is deployed in bridged mode?
While reading about ACE and NAT I came across the sentence "ACE is not able to NAT bridged traffic". What does it mean?
regards

sorry Marko but I am lost. We are talking now about one-armed mode of deployment. There
are 2 contexts and the same vlan is used in both of them (that's why it is shared). In this case I don' understand what you wrote "you have server A in the shared VLAN of context A, you can not reach a VIP from context B" ... that is the same vlan so I can't see any problems..... unless you are describing situation for bridged mode deployment of ACE.

Off Bridge Mode Question

Trying to determine how my Airport Extreme went into off-bridge mode....noticed my A.E. was blinking the amber light...after determining it was not an update alert, I unplugged the box from the socket, and detached all wires from the back of it...replugged, greenlight eventually came back on, but could not get onto the internet....called the 1-800 Apple number....tech determined I was indeed in off-mode, we fixed it, I'm back onto to the internet...forgot to ask her if unplugging the unit was what made it go into off-bridge...don't want to call back....but will if commnity can't answer the question....that is he question...did unplugging the unit, reset it into off bridge mode, or did I manipulate it within the dialogue box, and inadvertantly did something to put into off-bridge? Thanks for any and all hlep

Recycling power to the base station should NOT make any configuration changes. However, performing any of the potential resets can. The default mode of all of the Apple routers is NOT to be in bridge mode.

A question about bridge mode

I have a DSL modem which is set to distribute IP addresses. Wireless network is off.
A Time Capsule (connected to DSL modem by Ethernet) which is in bridge mode and creates the wireless network.
Question: should I be able to connect to Internet through a Ethernet connection at the Time Capsule?
thanks
Ken

I would first verify that the Time Capsule is setup as a bridge as follows:
Open Macintosh HD > Applications > Utilities > AirPort Utility
Click Manual Setup
Click the Internet icon
Connect Using = Ethernet
Connection Sharing = Off (Bridge Mode)
If all appears to be well, try connecting the ethernet cable from your gateway to one of the other ports on the Time Capsule. In other words, if you have it connected to the WAN port (circle icon) now, connect to one of the other three LAN <-> ports.
Truth be known, when the Time Capsule is setup in bridge mode, all the ports behave the same. It does not matter which you use. If the WAN port has taken a hit from a nearby lightning strike or a power surge, the other 3 ports may still be operational.
Any luck?
Message was edited by: Bob Timmons

Question about TC setup, bridge mode and security...

Hello All
I need some help...
Have bought a 1 Tb TC to use with my existing ethernet/wireless all-Mac home network but have some specific queries.
The system is set-up as follows:
Cable modem > connected by ethernet cable to > 8-way Ethernet switch
Connected via ethernet cable to the 8-way switch are: one MacBook (in another part of the house) and the TC (via its WAN socket).
Elsewhere in the house, and _all connected wirelessly_ are:
iMac G5
Powerbook G4
hi-fi (connected via an Airport Express)
Airport Extreme basestation to which a HP Laserjet is connected via ethernet.
Question:
Before buying the TC, I used a spare Airport Express basestation in its place to act as the 'main' basestation and the IP addresses of each device on the network were 10.0.0.1, 2, 3, etc. I had the impression that my home network was not "seen" by the outside world as a consequence of this.
Now, the TC seems only to work when in 'bridge' mode and it seems that the IP addresses are 196.xxx.x.100, 101, 102 etc. Does this mean that these devices are now visible to the outside world. Have I compromised my network security? I am worried that the outside world may have access to the contents of my TC, although my TC is password protected and the wireless network is 'closed'. What else should I be doing?
Finally, should I have set up the network so that the cable modem feeds to TC directly, with the 8-way ethernet switch coming off one of the ethernet sockets on the TC?
In all honestly, the instructions in the manual and the help guide are less than clear.
Can anyone help?
Thanks
Daniel

Section 4, here are my thoughts.
1. Since you are currently seeing individual IP addresses like 196.xxx.xxx.100, etc., it sounds like your modem is also acting as a router. This also seems to be the case since the Time Capsule is only working in bridged mode (it wouldn't work in Share a Public IP address if another device is assigning private DHCP addresses). Now, you could still allow the Time Capsule to act as a DHCP server on your private network by enabling Connection Sharing as Distribute a range of IP addresses. This will create a private network within your private network where all the devices that are connected to your Time Capsule can see each other. If you leave it in bridged mode then you allow your cable modem to assign DHCP addresses and all devices that are connected to the Time Capsule or to your ethernet switch are on the same network.
2. Assuming your cable modem is acting as a router you shouldn't have to worry about security, although you will have to access your modem's settings to make sure port forwarding isn't enabled and that the firewall is turned on (although I'm sure it is). I personally would plug the ethernet switch into the LAN port of the Time Capsule and allow the WAN port of the Time Capsule to be plugged into the cable modem. I also would just leave the Time Capsule in bridged mode as well, that's what I do for my own personal network.

Design question: ACE module connected to 2 different L3 engine while in bridge mode

fellow engineers,
i have been working on a design model , where the ACE mldule will provide SLB for both virtual and real servers. we have been deploying several UCS systems and the customer would like to use the ACE as our Enterprise SLB layer
configured in bridcge mode.
the msfc within the 6509 provide the L3 routing. however we may extends multiple vlans (v160-v163) via nexus switch layer (7k,5k,2k) to a FW appliance which now is the svi interface for the extended vlans. these vlans will be configured on a dedicated context.
the extension is based on the bridge mode operation as follow:
need help with the following:
1) if i have 4 bvi's configured, do i need to have default route configured?
2) my total count for vlans are: v160-v163 for server vlans, and v101 is the management vlan. the svi for this vlan is on the msfc card. the server GW are pointing to each dedicated svi's on the FW+L3 apliance.
3) if my default route on the context is pointing to the v160 svi on the FW+L3 engine, will that prevent the return traffic for other vlans ( v161-v163) from the ace toward the client?
4) is default route neccessary if you hae the ace in bridge mode.
it was brought to my attention that if you have multiple vlans configured in bridge mode pointing to another L3 engine, then each vlan would have to be configured on seperate context since you can only have one default route per context.
i appreciate any feedback on this inquiry. if you need additional information please le me know.
thanks and best regards,
raman azizian

Hi Raman,
You can have up to eight default routes in one context. What the ACE is doing with the entries is to create a ARP-entry with the name GATEWAY. If you need more then eight entries, just declare gateway as rservers. In that case the ARP-entry is stored as RSERVER instead of GATEWAY. The trick is to tell ACE to learn the MAC-address for the IP-address and store it int the ARP-table. The ACE never learn for itself a MAC-address. Don't forget mac-sticky enable on vlan's facing gateway.
I'm running one context in bridge mode and have 18 bvi's with FW and Router 6509 as gateways.
Exampel:
Interface to ROUTER 6509
interface vlan 300
bridge-group 300
no normalization
mac-sticky enable
access-group input BPDU
access-group input alla
access-group output alla
service-policy input lb-int-vlan300
no shutdown
rserver host 300GATEWAY
ip address 164.135.121.47
inservice
A#1/prod1# sho arp | i 164.135.121.47
164.135.121.47 00.08.e3.ff.fc.14 vlan300   RSERVER    4775   239 sec      up
A#1/prod1#
Interface to FIREWALL
interface vlan 802
bridge-group 802
no normalization
mac-sticky enable
access-group input BPDU
access-group input alla
access-group output alla
service-policy input lb-int-vlan802
no shutdown
rserver host 802GATEWAY
ip address 192.168.137.1
inservice
192.168.137.1   00.23.33.6a.bf.80 vlan802   RSERVER    4785   5 sec        up
Regards
Mats

Using "bridge mode" to extend a network question

I had been using my TC as my only wireless router. I recently obtained FiOS service and they provided me with a router that is working just fine. That router is in the basement. The house is wired for internet so I connected the TC upstairs thinking I could use it to extend the signal.
I put it in bridge mode but even when I'm in the same room my connecting devices don't show a very strong wireless signal. I'm wondering if I've set it up correctly.
I noticed when I go into the airport utility that wireless mode is turned off. Is this correct for what I'm trying to do?
If I turn on the option to "extend a wireless network) I'm not sure if I'm supposed to enter the name of the network currently assigned to my other router. A password is pre-filled in there it looks like but perhaps that from when I used to the TC by itself.
Under the "internet" tab, I have "connection sharing" set to "off-bridge mode." I think that's correct, yes?
Thanks.

Bridge mode is the correct setting for Connection Sharing on your TC, but you need to configure your wireless on the TC to "Create a wireless network" with the exact same name (SSID), security and password that the FIOS router is using. This will, in effect, expand your network. Your laptop will automatically connect to the device with the strongest signal as you move around the house. This is known as a "roaming" network, and it is the basic network design behind most commercial wireless installations.
The "extend a wireless network" setting is only used if you have another Apple "n" router as your main base station and you want to expand the network using wireless only, not ethernet. The "extend" setting would not be compatible with any of the FIOS routers, so you would not be able to use this setting on your network.

Help / Question - Must run in bridge mode?

Just bought and installed an airport extreme. I am using a Westell DSL modem to connect to verizon. The Airport Extreme will only install (and work) in bridge mode. It reports 2 NATs, i.e., the modem is assigning IP addresses. I cannot seem to get the modem and AE switched around so the AE assigns addresses.
Is this a problem? Is it okay to run the AE in bridge mode with the modem assigning the dynamic addresses?
Thanks

VaMichael, welcome to the discussions!
It is probably necessary to run the Extreme in bridge mode if your Westell is a modem/router handling DHCP and NAT functions.
If you want the Extreme to handle the DHCP and NAT functions, you would need to reconfigure the Westell into bridge mode. Check your documentation on the Westell as most modems can be configured using something like a 192.168.1.254 address entered into your browser.

CSM - Bridged Mode - Routed Mode Question

Customer's request involves setting up a backup (failover) BCR server to receive hand held device scan events.
The following needs to be performed:
- Build new server up as identical to AAEPRDBCR01 (named AAEPRDBCR02).
- Application to be installed onto the new server (configured identically to AAEPRDBCR01)
- Configure customer's CSM to parse requests to AAEPRDBCR01, and failover to AAEPRDBCR02. i.e. when BCR01 is unplugged the CSM should realise and begin parsing requests through BCR02. If BCR01 comes online again, the requests should once again fall back to BCR01.
I was thinking that the two servers would reside on eg.....VLAN 13 'BiscomBCR' and Users access these servers.
Does it need to be routed or can we do the same config in Bridged mode, where the servers have the same IP addressing?
Any pointers to any useful links is much appreciated.

You can do this in bridged mode. You can basically create a backup serverfarm which contains your new server. (CR02). It will only be used if the normal serverfarm containing your existing server (CR01) is unavailable.
Attached is a link to the CSM config doc - have a look at the config examples for the backup server farm. (Make sure you read the caveats about stickiness to understand what happens when the primary serverfarm comes back on line).
http://www.cisco.com/en/US/products/hw/switches/ps708/module_installation_and_configuration_guides_book09186a0080470b20.html
Hope this helps

Is it possible for SA540 to work in transparent bridge mode?

Hi all,
I've been considering to use a Cisco SA540 in an industrial project; please consider Scenario 1 and 2 files attached (bear with me - I'm an engineer, not an artist).
All networks mentioned in both scenarios are regular and well known Ethernet TCP/IP networks. The Corporate Network and Automation Network (including the DMZ) are in different subnets. The Corporate Network is the biggest one, similar to any company's corporate network you all know. The Automation Network exists for the purpose of operating and maintaining the industry process; it's smaller but highly critical. Only specific staff (automation staff and dedicated operators) have access to it. Although many devices and networks in the Automation Network are industry specific - not so well known, a small segment of it is plain Ethernet TCP/IP, as I've already stated. The Automation Network has a DMZ, where we lay servers that provide industry process information for the Corporate Network.
Scenario 2 may look at a first glance the best option, since it's simpler, doesn't require another router and benefits from Cisco SA540 support for both a LAN and a DMZ. The problem with Scenario 2 is the following:
Since both networks are maintained by different teams under different management, TI staff would have absolute control over the Cisco SA540. This way automation staff could not grant that the Automation Network is really protected from the Corporate Network.
TI staff may even demand for another device to interface with the Automation Network - which is not Cisco SA540, since they rule everything that lives in the Corporate Network. In this case, I have my hands tied!
Scenario 1 solves the above problems. Since automation would have absolute control over the Cisco SA540, they could grant security for the Automation Network (except for DMZ, but that's the reason why it is called a DMZ!). TI staff could ask for any router they prefer to interface with the DMZ, I would never mind about it.
Considering the above, I will probably be forced to adopt Scenario 1 instead of Scenario 2. So here comes my question: is it possible for Cisco SA540 to work with the same subnet for both WAN and LAN interfaces (in Scenario 1, no DMZ interface is required)? In other words, is it possible for Cisco SA540 to work in transparent bridge mode? I've been through all of the Cisco SA540 Administration Manual and as far as I could understand, routing is not an option - it is demanding.
Although I understand I could adopt Scenario 1 and still have different subnets for DMZ and the rest of the Automation Network by connecting the DMZ to the WAN interface and the rest of the Automation Network to the LAN interface in the Cisco SA540, I believe it's not worth the effort. The Automation Network is so small and we do all we can to keep it as simple as possible.

Adriano, there is a RV042G, which supports the gig ports and a 800 mbps nat throughput. Here is the datasheet
http://www.cisco.com/en/US/prod/collateral/routers/ps10907/ps9923/ps12262/data_sheet_c78-706724.html
If you are using a DSL connection, the SRP527/547 models may be an alternative. These models support the RFC 1483 Bridges EOA Please note the SRP547 should be 10/100/1000. Also note the SRP521/541 are Fast Ethernet units and they do differ from the SRP527/547. The main selling point of these devices are the FXS/FXO ports. So this may also be a bit of an "unfocused" solution. But it's worth throwing the idea out there!
Here is the admin guide;
http://www.cisco.com/en/US/docs/voice_ip_comm/unified_communications/srp540_series/administration/srp500_AG_2567701.pdf
Here is the datasheet;
http://www.cisco.com/en/US/prod/collateral/voicesw/ps6790/gatecont/ps10500/data_sheet_c78-550705.pdf

Question re: BR1310 in Workgroup Bridge Mode

Similar Messages

Maybe you are looking for