Setting Locally Switched VLAN Id for HREAP'd ap's?

I am using HREAP on a number of AP's to fulfill a need of my end-users to have wireless devices connect to a locally hosted resource on a sites network. Getting the AP's to operate correctly has not been an issue (for the most part), and getting the "Locally Switched VLAN's" functional was not a problem. However, when I routinely go back through my AP's to check on them or to look t-shoot an unrelated issue I have noticed that some of the AP's have retained the Locally Switched VLAN mapping (i.e.: WLAN Id=5, Profile Name = test ssid, VLAN Id = 123) and some of them resolve the VLAN Id to 1 (for example).
Is the anyone that may have experienced this and can offer or point me towards a resolution?
I am also curious if I can configure the Locally switched vlans directly to my WiSM's instead of to each individual HREAP'd AP?
BTW: I have a wireless environment of 1242, 1252, and 1142 ap's with WiSM's on a 65xx w/ sup720.
Thanks for the help.

I saw similar behavior at a client site running 6.0.181.0 & 6.0.196.0 code, what I found the issue to be was that when you set the native vlan and hit apply the AP took a minute to initate a reboot (or so it appeared) and when I set the VLAN Mappings they weren't actually being applied.
I found if I set the AP to H-REAP and applied that then waited about 3-4 minutes, then enabled VLAN Support and set Native VLAN, apply that, wait 3-4 minutes, then set my VLAN Mappings that the issue went away.
Not sure if that's the same issue your running into but it's worth a shot.. I tried tons of things before discovering that pattern.. Incidentally it didn't seem to behave that way in 4.0 code nor does it seem to behave that way in 7.0 code.
Hope this helps...
Please rate useful posts.
Thanks,
Kayle

Similar Messages

L2VPN Local Switching VLAN to VLAN issue on 7200VXR/NPE-G1

I've been working with a client trying to get this working. We tried 12.2(31)SB6, 12.4(15)T1 IP Services and 12.4(15)T1 Advanced IP Services.
It works fine for Ethernet to Ethernet, or Ethernet to VLAN, but it doesn't work for VLAN to VLAN either on the same interface or on different interfaces. We've tried this on both a Cat5505 as well as a Cat294XL thinking that maybe there would be some issues with one platform or the other.
Here's an example:
! VXR (12.4(15)T1 Adv. IP Services)
interface GigabitEthernet0/1
no ip address
duplex full
speed 100
media-type rj45
no negotiation auto
interface GigabitEthernet0/1.202
encapsulation dot1Q 202
interface GigabitEthernet0/1.203
encapsulation dot1Q 203
connect test GigabitEthernet0/1.202 GigabitEthernet0/1.203
! Cat 5505
set vlan 202 9/1
set vlan 203 9/2
set port name 9/1 PC1
set port name 9/2 PC2
set port name 9/3 VXR-G0/1TRUNK
clear trunk 9/3 1-201,204-999
set trunk 9/3 on dot1q 202-203,1000-1005
We seem to be able to sequeeze a few packets through every once in awhile - like 1 or 2 every 20 or 30 packets:
64 bytes from 192.168.1.1: icmp_seq=10 ttl=64 time=0.604 ms
64 bytes from 192.168.1.1: icmp_seq=18 ttl=64 time=0.638 ms
64 bytes from 192.168.1.1: icmp_seq=40 ttl=64 time=0.621 ms
64 bytes from 192.168.1.1: icmp_seq=48 ttl=64 time=0.608 ms
64 bytes from 192.168.1.1: icmp_seq=70 ttl=64 time=0.605 ms
64 bytes from 192.168.1.1: icmp_seq=78 ttl=64 time=0.630 ms
As you can see from the below show interface, the interface is receiving lots more packets than it's sending:
Router#show int g0/1
GigabitEthernet0/1 is up, line protocol is up
Hardware is BCM1250 Internal MAC, address is 001c.b0fa.101b (bia 001c.b0fa.101b)
MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation 802.1Q Virtual LAN, Vlan ID 1., loopback not set
Keepalive set (10 sec)
Full Duplex, 100Mbps, RJ45, media type is RJ45
output flow-control is unsupported, input flow-control is XON
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:00, output hang never
Last clearing of "show interface" counters 00:00:15
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 1000 bits/sec, 2 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
40 packets input, 2836 bytes, 0 no buffer
Received 36 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 19 multicast, 0 pause input
8 packets output, 672 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 PAUSE output
0 output buffer failures, 0 output buffers swapped out
Router#
Does L2VPN Local Switching VLAN to VLAN not work on VXRs or something?
This link seems to indicate that E-E VLAN is supported in 12.4(11)T.
http://www.cisco.com/univercd/cc/td/doc/product/software/ios120/120newft/120limit/120s/120s27/fslocal.htm#wp1149105
What am I missing?

Hi,
In ASR9k, VLAN is port significant so yes you can match the same VLAN on different port.
For your untagged traffic, both UPE fo site 1 will think they are directly connected via two links so yes STP should take care about the loop
For your VPLS domain, if you are not using VLAN 100 on site 3, you need to pop the tag on both ASR9k. Also do you extend STP to site 3 ?
SVI is not supported in ASR9k today so you have to use unumbered interfaces instead:
interface Loopback1
ipv4 address a.b.c.d 255.255.255.255
interface g0/7/0/0.200
encapsulation dot1q 200
ipv4 point-to-point
ipv4 unnumbered Loopback1
proxy-arp
interface g0/7/0/1.200
encapsulation dot1q 200
ipv4 point-to-point
ipv4 unnumbered Loopback1
proxy-arp
I never tested it in this situation but from STP perspective those links should be seen as host connection.
Let me know if it works
HTH
Laurent.

HREAP local switching with web auth

Hello All,
Does web authentication work perfectly fine while locally switching the SSID on Hreap mode APs with older WLC firmwares - 7.0.98.218.
I see it is supported in 7.0.116.0 onwards. Does it work on older versions? Has anyone tested and faced any issues?
Thanks
Jeen

It worked as far back as 4.0 from what I remember
Steve
Sent from Cisco Technical Support iPhone App

HREAP - Local switching

Hi All,
I have a working WLC with several HREAP AP's all Woking as they should, my question is what happens to dhcp requests when an AP is configured for HREAP local switching with no VLan support enabled ( connected to an access port not a trunk)? The local VLan has a dhcp helper address configured for an external DHCP server When a wireless client connects does all the traffic get dropped directly onto the local VLAN (in my case VLAN 10) or does any traffic transverse through the controller? I ask this because on the advanced setting page of the WLAN I have ticked DHCP REQ, how does the controller determine if the wireless client has a valid IP if the DHCP request is being supplied by the local VLAN.
I was under the impression that the control and data planes are separated?
Thanks in advance for any replies.
Sent from Cisco Technical Support iPhone App

You are correct, it gets dumpped on your vlan 10. As for your very specific question, thats a great question and I dont know that I have the anwser. Perhaps someone else like Steve, Leo or Scott can reply if they tested it.
Im going to take a stab in the dark and say perhaps the ap makes sure it sees a dhcp req packet come in before it allows the client to get into the run state.
OR, its doesnt work.
OR, if that check box is marked, perhaps the ap relays some type of response back to the WCL ...
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin

HREAP local switching works perfectly BUT central switching fails when WLC is down. Doesnt fallback to local switching.

Hi All,
I am currently using as 4402 with 6.0.196 image. The APs that i am using is the 1130.
I have configure HREAP for Local switching, it works very well. I am even able to do 802.1x
Authentication after registering with ACS. Currently I am usng only 1 SSID. That SSID is mapped
to vlan 10 and my AP is on native Vlan 1.All the proper trunks and routing has been enabled.
The issue i have is that when I am trying to create a central switched WLAN that fallbacks to local
switching once the controller is down. The only diffrerence I made was to remove the "tick"/checkbox option
for "local Switching" on the WLAN page.
It is able to work if the controller is up, I am even able to get the IP network where the controller resides. However when
i tested by disconnecting the controller, The client is unable to authenticate or send traffic anymore. I've tried using WPA-PSK
and also WPA-PEAP-MSChapv2. Both fails miserably.
Does this mean that I need to create 2 WLANs? One for Local Switching and the other for Central Switching on the HREAP mode
APs.Cant i do it with just a single WLAN?
Thank you.
Warmest regards,
Azzafir Ariff Patel.

For h-reap, if your doing centrally switch due to using EAP for authentication and the ap looses connectivity to the WLC, then those users should be able to stay associated, but new users will not authenticate. WPA/WPA2-psk local switching should work even if the ap looses connectivity to the WLC since the h-reap ap will do the authentication. Here is a link you probobly already seen:
http://www.cisco.mn/en/US/products/ps6087/products_tech_note09186a0080736123.shtml#topic2

RV110W - trying to set up 2 VLANS - are there docs / help for this?

I am trying to set up an RV110W router with 2 VLANs - 1 for guests to the office to just have internet access via wireless and another for employees to be able to access the LAN and internet wirelessly. I have not done anything with VLANs before, so please bear with me.
I thought this would be simple, but banging my head against the wall with all the terms in the docs:
http://www.cisco.com/en/US/docs/routers/csbr/rv110w/administration/guide/rv110w_admin.pdf
port 1 is connected to a wired LAN / unmanaged switch with office PCs. So these machines / nothing on this subnet tag the packets before they get to the router. This subnet is using 10.10.1.0/24
Port 2 is connected to an Engenius EAP 300, a wireless access point that can broadcast SSIDs and tie each SSID to a different VLAN.
SSID1 is called Private and is set to be VLAN 1. There's encryption on this SSID - only office staff would be able to log on.
SSID2 is called public and is set to be VLAN 10. There's no encryption on this SSID.
I know - the router also does this, but where the router is vs. where the wireless is needed, we need to have the Engenius at that remote location.
I have the RV110W set to give out 10.10.1.0/24 IPs when you connect to the SSID1 / VLAN1
And it gives out 10.10.10.0/24 IPs when you connect to the public SSID / VLAN10.
Both get on the internet fine. The only issue is how to set the VLAN membership for each port / and any other settings so that the wireless devices on VLAN 1 can get to the LAN devices on Port 1. (and the public / vlan 10 devices on the wireless network to NOT get to the devices on port 1, but i think that's working.
I played with tagged / untagged / excluded, for the port membership, but either the wireless VLAN 1 devices get blocked from even the web (when port 2 is set to untagged, since they ARE tagged VLAN1) or they can't get to port 1 when set to tagged, since the port 1 devices are all untagged and the reply packets get blocked?
the doc for this unit talks about inter-vlan routing but doesn't explain what that is. THe wireless isolation should be turned on for vlan 10, right? We don't want guests to be able to access other guest's machines?
I saw on page 71 on how to set up the guest network, but that's using the wireless built into the box, not a wireless access point.
Overall, what I want is:
VLAN 1: port 2 (with tagged VLAN1 packets) and port 1 (with untagged packets) can pass data between each other and access the internet
VLAN10: port 2 with tagged VLAN10 packets can only get to the internet.
Is that doable?
How?

thanks. Still not working
For the vlan membership page
when set like this:
           port1         port 2
vlan1     untagged    untagged
vlan10 excluded     tagged
connecting to the vlan1 wireless SSID on port 2, I can't even get an IP address from the router (the dhcp request can't even come through port 2 because it's saying vlan1 packets have to be untagged?
connecting to the vlan 10 wireless SSID on port 2 gets a DHCP address and can only get to the web, so that's good.
If I change the membership to:
                  port1 port 2
vlan1 untagged tagged
vlan10 excluded tagged
connecting to both SSIDs on port 2 will get you a dhcp address, and vlan1 devices can get into port 1, but trying to admin the wireless access device on port 2 or even pinging it, now fails - 'cause the router gatekeeper says if you want to come through port 2, your packets have to be tagged? and the packets from port 1 to port 2 are untagged?
If I change the membership to:
            port1 port 2
vlan1   tagged tagged
vlan10 excluded tagged
connecting to both SSIDs on port 2 will get you a dhcp address, but replies from the wired PC on port 1 / vlan1 vlan1 can't get back out of port 1 'cause the router gatekeeper says if you want to leave through port 1, your packets have to be tagged? and the ping reply is coming form a device with untagged packets? although the devices on vlan1 / port 1 CAN get on the web with their untagged packets.
the wireless device says it supports 802.1q
http://www.engeniustech.com/resources/EAP300_DataSheet_v2.1.pdf
when they say port 2 / vlan 1 tagged, is it saying packets coming in FROM devices on that port have to be tagged? Or packets going TO devices on that port have to be tagged? or both directions?
Any advice?

Multiple VLANs per SSID with local switch

Is it possible to use an 'AP Group' or 'Interface group' to assign multiple VLANs to a WLAN when remote, h-reap APs are in local switch mode?
If not, is there a way to overcome 500 maximum host per VLAN when APs are local switching?
Thanks!

dont think its possible...
I donno if the following config will even work but u can have the hreap APs connected at the remote site to map to different vlans...
Example:
AP1 -- ssid 1 --- vlan 10
AP2 -- said 1 --- vlan 11 and so forth..
Sounds crazy but i ll have to ponder on this a bit more.. Need a pen and paper to draw a quick topology :)...
Sent from Cisco Technical Support iPhone App

HREAP, Local Switched WLAN and DHCP Address required

Hi All,
if i have configure an HREAP AP with a local switched Wlan with "dhcp ADDRESS REQIRED", from my understanding a client will be provided with an ip address from the hreap local infrastructure. How will the controler ensure that no static ip client is able to access the network?
Any Help Welcome.
Regards, Michael

I posted about this subject on my site (see link below). Since the posting I learned that the client needs to minimumally pass a DHCP discovery packet for the controller to then allow traffic to pass to the client. This is how it "safe guards" someone putting a static address on their box ...
http://www.my80211.com/cisco-wlc-cli-commands/2009/12/30/wlc-dhcp-address-assignment-required-option.html

Question about VLAN handling for virtual switches and vnets

Regards,
We are encountering some problems when using VLAN tagged 10g ethernet. We assign the VLANS to the vsw like this:
ldm add-vsw net-dev=net2 mtu=9000 vid=vid1,vid2,.... mode=sc primary-vsw0 primary
the mode=sc is due to us planning for possible Solaris Cluster installation for some guests. The guest get its vnets like this:
ldm add-vnet mode=hybrid vid=vid1 vnet0 primary-vsw0 guest
we use mode=hybrid since this is a NIU 10 gig eth interface in a T4-4. My questions are:
1. Do you see any problems with this config ?
2. Do you know of any problems with using VLAN tagging in virtual switches/virtual nets for LDOMs ?
3. When adding, subtracting VLANS to the vsw does it need to recreated or does a ldm set-vsw vid=vid1,... work dynamically (this goes of course for other vsw properties as well) ?
This is VM Server for SPARC v2.2, Solaris 11 for control and service domains, solaris 10 in the guest LDOMs.
Thanks,
Edited by: DamnGoodCoffee! on Nov 2, 2012 4:59 AM

Hi,
1.
- If you want that the vnet is handling the VLAN tagging for you, you need to set the pvid.
- If you want to do the VLAN tagging in the guest LDOM (via the interface name vnetVLANID00x), it is OK.
2. We use VLAN tagging in vnetX via setting the pvid for the vnet for guest LDOMs, and we use the interface name based VLAN tagging in the primary domain on the vsw interface.
3. You don't need to recreate, you can set it. I'm not sure if you need to reboot to let it take effect, but IIRC it is dynamic (should be easy to test).
Bye,
Alexander.

Central Authentication / Local Switching for Mesh?

Hi all,
I'm afraid I know the answer but maybe I'm just missing something. Anyway, here's the situation: I have a multi-site installation with a centralized WLC (currently 2504). Each wireless VLAN at each site uses the same ID but has a local network (e.g. site 2 is 192.168.2.0/24, site 3 is 192.168.3.0/24 but both are VLAN 100).
When I configure APs for H-REAP/FlexConnect, there's no problem. Users are authenticated via a centralized RADIUS server (Cisco SecureACS 5.x) and I have local switching enabled so clients pick up an address from a localized DHCP server (ASA firewall in most cases).
However, the impetus for installing the WLC requires a mesh network, consisting of 2 RAPs and 2 MAPs. My catch 22 is now this: if a RAP is in FlexConnect mode, the MAP won't associate, but if the RAP is in RAP mode, the MAP associates, but clients don't appear to get IP addresses (on an iPhone for example, the wheel just keeps spinning until it gives up).
It's my understanding that since the APs are no longer in FlexConnect mode, all the wireless traffic is now being tunneled back through the centralized WLC which associates the VLANs with networks that don't exist on site.
Is my understanding correct? If so, is there any way I can go about achieving what I want to do which is get the FlexConnect effect but still have Mesh capabilities? Right now it seems the obvious (albeit very expensive answer) is to decentralize the WLC and have HA WLC configured on a per site basis.
Any input/advice greatly appreciated. Thank you.

I second your thought about mesh and as for what to do - I don't think you can do anything. Perhaps, a cheap way to solve this problem can be installing a local 2504 at sites that require mesh links. This will allow you terminating all VLAN/SSID mappings locally. Sorry :-(

Flexconnect - local-switching - Interface Groups - multiple subnets/vlans

So I'm trying to setup an "interface-group-like" configuration on some Flexconnect APs with local switching enabled in order to support multiple subnets/VLANs linked to a single SSID.
Does anyone know if this is possible or have any suggestions?
I've tried:
AP Groups - One SSID which would require central switching for it to be of use (I think).
AP Groups - Creating an additional SSID and then placing the APs in a group per site. This works but is going to be difficult to manage if I have 400+ sites running this sort of setup.
For reference, my end goal is to have multiple (400+) branch sites with the same WLAN mapped to 3 or 4 different VLANs in order to split the subnets up into smaller chunks (/23s or /24s). These VLANs are all switched locally and are uniform in numbering across all the sites from a layer 2 perspective.
Thanks,
Ric

Interface groups is not an available feature on FlexConnect. FlexConnect doesn't support layer 3 roaming if devices roam from one FlexConnect ap to another and the wlan to vlan mappings are different. This is a limitation to FlexConnect along with a few others listed in the FlexConnect deployment guide.
-Scott

L2vpn interworking options for Local Switching

Hi All
theres not much offered by cisco for interworking local attachment circuits for atom l2vpn. ive looked it up, but im specifically wondering about the FR-ethernet/vlan or PPP-ethernet/vlan couldnt find any references for those. are these possible locally on the same router. what are the supported platforms.
Thank you
-Glen

Hello Glen,
here's some documentation about local switching:
http://www.cisco.com/en/US/docs/ios/12_2sb/feature/guide/28sblcl.html
http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/fslocal.html
Hope that helps.
Antonio

TACACS login 1st attend fail and prompt for local switch password

Hi,
The switch will prompt us the local switch password after we key in wrong username and password when prompt by the switch. We are wondering is this behave correct or normal?
This is because any hacker can just try on first the login which is prompt by TACACS then they can try hacking to the switch using the switch local password.
This there any work around that each attend is prompts for TACACS login? Only when TACACS server is down will be prompt by the switch local login?

Hi Farrukh,
Here is the tacacs-server setting:
tacacs-server host 10.130.209.23
tacacs-server host 10.130.209.24
tacacs-server directed-request
tacacs-server key xxx
Result is the same even I have remove those two commands.
I ahve attached the debug result obtain from the switch without those two commands.
And below is the scenario on the login when the debug is turn on:
Username: ivan
Password:
Password:
% Authentication failed
User Access Verification
Username: TanCH
Password:
Password:
% Authentication failed
User Access Verification
Username: siah
Password:
Password:
% Authentication failed
=---------------------------------------------------------------=
All Access to this system will be LOGGED.
All UNAUTHORISED access is PROHIBITED and will be dealt with seriously.
=---------------------------------------------------------------=
User Access Verification
Username: ivancheng
Password:
SWB1111>exit

How to set up with cacheing DNS for local network?

Our new Lion Server has a static IP Address pointed to over the internet by our registrar's zone file. Planning the Lion Server installation process with the intent of hosting Web, Mail and Open Directory services to a small number of users who are nearly all located off-site. I do also want Lion Server to be a caching DNS Server and DHCP authority on the local network to replace what dnsmasq does on our current Linux server.
I am looking forward to offloading some of the lower level Linux administration tasks and putting myself in the hands of the Lion Server Setup Assistant and Server App :-) but at the same time don't understand some of its assumptions and fear having to spend a lot of time experimenting and re-installing.
So, specifically, I want the Server App to know that my Lion Server has a "Host Name for the Internet" but that the DNS it sets up will not be the DNS for my zone - I will be managing that through my registrar's interfaces.
Second problem is my fnot understanding what name space devices on the local network will / should use. e.g. The Linux server will be available for backups etc on the local intranet (and optionally have a static ip address on the Internet) but MacBooks, PCs, iPads and iPhones will be served ip addresses by the Lion Server's DHCP. So will / should these dynamic devices have their machine names fully qualified by our domain name with RFC 1918 style ip addresses or something like .local? How do I tell this to Lion's Server App / Setup Assistant? How easy is it to update these initial settings later?

You do indeed need to have a master zone on lion server. There's no way to get around that since Open Directory depends on Kerberos and Kerberos depends on the DNS. LS scripts may see that the rDNS record exists, but I highly doubt that it'll auto configure everything for you... and given the number of possible variables, I bet that even if it worked something would need additional tweaking.
Sounds like an interesting lab excersize. You should try it on a test server!
Again... you just need to folow the set up procedure that Lion Server presents you with.
It won't be smart enough to see your external records and use them to configure a key distribution center for your OD.
As far as your caching needs... Could you set up your DHCP server to set the DNS server setting to show your internal server as the first hit, and your external as the second? That way when the client requests a resolution it'll not get a hit on your local server but will from the external?
The question then is how long will it wait for a response from the first server? Or will the first server respond with "I don't know" sending the client immediately to the second.
The server set up that I have works similarly. I have an internal master DNS that is replicated to a secondary. The first DNS has an A record (community.server.com) that points to the INTERNAL ip address of the secondary server that's also running the web service. The first server is running DHCP. It tells the clients to use the first and second servers as it's DNS lookup.
Now... Externally, my registrar hosts an A record for community.server.com that points to the external IP address of my router which then forwards the request to the proper port on the internal network.
This way, the local clients internally look up and get a response locally when they go for community.server.com. Externally, clients that look up community.server.com get the external connection to the router in my school.
Yikes... I fear that this is as clear as mud!
-Graham

How to set up a VLAN for a School Network for student ipads/ipods?

I work at a small private school that is going to implement about 20 ipads for classes. Students bring their ipods and iphones and are connecting to the existing unsecured wireless access points and are taking up the remaining IP addresses in the DHCP scope. I am running out of IP addresses and was wondering if I could set up a VLAN using the Cisco WRVS4400N for all of these wireless devices the students will be using. I plan to pull out all unsecured wireless AP's and replace with what ever solution we come up with. I will need about 6 access points/routers to cover the entire school. There is not a lot of money for technology and the ipods were donated. I have never set up a VLAN before. Is there an inexpensive way to allow the students with their personal ipads/ipods and the 20 ipads owned by the school to connect to a VLAN to keep from using up our DHCP IP addresses from the server. Thanks in advance.

Hi pctiger92!
The WRVS4400N is now being handled by the Cisco Small Business Support Community.
For discussions about this product, please go here.

Setting Locally Switched VLAN Id for HREAP'd ap's?

Similar Messages

Maybe you are looking for