WCS and WLC, On the same VLAN ?

Whats best practice ? Is it better to have the WCS on the same vlan as the controller(s)
Johann Folkestad

Given the fact that it is snmp traffic, the WCS to WLC snmp read/writes should be confined to a subnet(s) that are secured by ACLs/firewalls/rfc1918 address space, yada yada....
One way to do it is to place the WCS behind a firewall on the same or reachable subnet as the WLC service or management ports. I prefer using the service port on the WLC for the WCS snmp traffic, this way I can prune that vlan off the switch trunk ports that the WLC connect to as well as put it in a subnet that is away from prying eyes. I have had it working just fine since 3.0.2x all the way up to the latest rev this way.
the controller will touch an additional vlan for each dynamic interface you create for wlans
You can also dual home the WCS server, but the default option on WCS install/upgrade is to bind to one interface (it will detect & prompt in regards to multiple interfaces - at least on the Linux version).
Also don't forget to lock down https access to WCS web frontend as well

Similar Messages

CSS - src and dst in the same vlan

Hi guys,
I need LB something like this in routed mode:
first data flow:
[client]->[vip1-c(css)]->[www1/www2]
and second (backend) flow is:
[www1/www2]->[vip2-c(css)]->[www3/www4]
vip1,2-c = VIP address on client side
www1,2,3,4 = all servers are in the same VLAN
problematic is second data flow (www1/2 -> vip2 -> www3/4(because www3/4 are in the same VLAN as www1/2).
I have two solution for this:
1. migrate www1/2 and www3/4 to the independent VLANs (this can be design problem in existing topology)
2. communication from www1/2 with destination to www3/4 translate to IP address located on the CSS using group, but I'm not sure if it's possible, or how it's possible to configure on the CSS.
group gr1
add service www1
add service www2
add destination service www3
add destination service www4
vip address ip-from-client-side(for example vip2-c)
active
it's possible to use this configuration?
martin

The group is a good solution.
However, the way it was configured is incorrect.
You either specify the source or destination.
So, if you want to nat all traffic from www1 and www2 you leave the 'add server www1' commands and remove the 'add destination service www3'.
Or you can nat all traffic going to www3 and www4. In this case, you remove the 'add service www1' and keep the others.
Another way of doing this would be to remove all 'add ..' commands and use an acl to specify when to use the group using the option 'sourcegroup gr1' inside the acl.
Gilles.

[ACE] Real servers and VIP in the same VLAN

Hello.
I´m facing an issue because the real servers and the VIP address are in the same VLAN, when a request comes from an external client to the VIP (crossing an ASA firewall) , the ACK gets back using the IP of one of the real servers instead of the VIP so this traffic is blocked by our WAN firewall probably due the inspection rules.
My question is if there is some way make the VIP the address who ACK´s that requests? Creating a new VLAN would be complicated because there are other services already running on those real servers.
Thanks a lot,
Miquel

Hi Miquel,
Please do source nat on ACE so that return traffic gets sent to ACE and not FW. Pasting an example for you.
     ==========================================================================
     One-Armed Load Balancing with VIP, Servers, & NAT Pool on the Same Subnet
     ==========================================================================
login timeout 0
access-list ANYONE line 10 extended permit ip any any
rserver host SERVER_01
ip address 192.168.1.11
inservice
rserver host SERVER_02
ip address 192.168.1.12
inservice
rserver host SERVER_03
ip address 192.168.1.13
inservice
serverfarm host REAL_SERVERS
rserver SERVER_01
    inservice
rserver SERVER_02
    inservice
rserver SERVER_03
    inservice
class-map match-all VIP-30
2 match virtual-address 192.168.1.30 tcp eq www
class-map type management match-any REMOTE_ACCESS
description remote-access-traffic-match
2 match protocol telnet any
3 match protocol ssh any
4 match protocol icmp any
policy-map type management first-match REMOTE_MGT
class REMOTE_ACCESS
    permit
policy-map type loadbalance first-match SLB_LOGIC
class class-default
    serverfarm REAL_SERVERS
policy-map multi-match CLIENT_VIPS
class VIP-30
    loadbalance vip inservice
    loadbalance policy SLB_LOGIC
    loadbalance vip icmp-reply active
    nat dynamic 1 vlan 451
interface vlan 451
description Servers vlan
ip address 192.168.1.2 255.255.255.0
access-group input ANYONE
service-policy input CLIENT_VIPS
nat-pool 1 192.168.1.10 192.168.1.10 netmask 255.255.255.0 pat
no shutdown
ip route 0.0.0.0 0.0.0.0 192.168.1.1
Let me know if you have any question.
Regards,
Kanwal

WCS and WLC AP values not fully in sync.

I have recently added several new aps on my network,after they connect to the controller, I set a hostname, and change the ip address to a static. However, WCS still sees the aps by the old ip and host name despite going into each one, hitting audit, and then save, any way to fix this? Thanks.

You may want to also consider the following:
1) Both the WCS and the WLC need to be at the same major revs (i.e.: The if the WCS is at v4.2, then the WLC should also be at 4.2). Failure to do so results in some significantly bizarre behavior such as errors after an audit - at least that was my experience.
2) You may have better success if you make the change from the WCS which pushes the change to the WLC and that way the WCS is already aware of the change. (Normally, this should work - I know of one instance where it does not: changing Master Controller Mode from the WCS).
3) If you feel strongly about making the change in the WLC (and are running a newer version of code in the WCS/WLC - i.e.: 4.x), there is a setting that forces the WLC to send configuration changes to the WCS once APPLY and "Save Configuration" are clicked:
From the *WCS*, click on Configure->Controllers and click on the controller you wish to change, and check the "Refresh on Save Config Trap" check box and click OK.
This will cause the controller to push any configuration changes up to the WCS after an APPLY and "Save Configuration" are clicked.
4) In terms of getting the WCS to actually synch up with the controller (assuming the WCS and WLC are at the same rev. levels), you may need to do what I did (this was subsequent to upgrading to v4.2 in both the WLC and WCS and having chronic "mismatch" status between the WCS and WLC):
From the WCS:
Configure->Controllers, check the controllers you wish to synch up. From the dropdown, select "refresh config from controller"
Next, select the DELETE option (instead of the RETAIN option). I believe that there are bugs in the software that upgrades earlier revisions to 4.2. I know that it might seem undesirable to DELETE information in the WCS, however, if you choose "DELETE", it seems to get rid of the residual information from the previous revisions that did not upgrade properly and the WCS will now be in synch with the controllers. DELETING the other settings makes the audit errors go away.
Subsequent audits may go better for you after performing the step shown above. However, you may need to repeat this process in item 4 above once or twice more until the database gets cleaned up, but after that my own experience has been that the WCS and WLC will eventually stay in synch.
It is unfortunate that we are forced to come up with workarounds like these when the software should clearly be able to handle this on its own, but we do what we must to get the job done.
Hope this helps,
- John
(Please rate helpful posts)

Flexconnect, branch and central site have same VLAN's

Is anyone familiar with a flexconnect deployment where on the central and branch site the same VLAN's are in use?
On both sites the following VLAN's are in place:
VLAN 32 = BYOD
VLAN 31 = USER
VLAN 40 = VOICE
On the branch site I want to deploy Flexconnect. When creating the VLAN mapping in the AP configuration all the VLAN's are instantly assigned. For local branch DHCP ip-helper addresses are configured on the branch switch. When a client connects to the Flexconnect AP it doesn't get an IP address. Suggestions?

Hi Thomas,
On the WLC location, your clients get IP? How did you setup the DHCP Server: on interface level or DHCP Override?
For the FlexConnect sites:
- enable Vlan Support?
- specify Native Vlan for the AP mgmt Vlan
- add Vlan Mapping: Wlan to sites's Vlan
- finally: configure accordingly the switchport:
switchport mode trunk
switchport trunk native vlan ...
switchport trunk allowed vlan all

Rogue AP - Not in sync with WCS and WLC

WCS - 7.0.164.0 and WLC - 7.0.98.0.
For some reason, I am seeing rogue ap alert on WLC and am not seeing on WCS. How do I clean up database and sync with WCS and WLC.
I am seeing same thing with coverage holes.
- Allen -

Allen,
On the WLC go to Management > SNMP > Trap Controls, make sure that you have the traps checked.
HTH,
Steve
*Please remember to rate helpful posts*

ACE30-MOD-k9 in bridge mode. Individual server in the same vlan of Real Servers not reacheable.

I configured ACE30-MOD-K9 in bridge mode and I configured a server farm with his real servers. The traffic passes and is balanced correctly between all RSERVER. But I can not contact a server that is on the same vlan of the serverpharm but doesn't belong at this serverfarm.
I Thought that the traffic directed to this "spare" server shouldn't be balanced but the bridge should permit traffic to pass. (trasperent mode) Is it correct ?
What does ACE in bridge mode with traffic directed to servers that do not belong to any server farm but are present on the same VLAN (same bridge group)?
In rispect at the following configuration 10.10.10.168 isn't reacheable
access-list INBOUND line 8 extended permit ip any any
access-list INBOUND line 16 extended permit icmp any any
probe http HTTP_PROBE1
expect status 200 200
rserver host RS_WEB1
ip address 10.10.10.163
inservice
rserver host RS_WEB2
ip address 10.10.10.164
inservice
rserver host RS_WEB3
ip address 10.10.10.165
inservice
rserver host RS_WEB4
ip address 10.10.10.167
inservice
serverfarm host SF_FIREGROUP
rserver RS_WEB1
    inservice
rserver RS_WEB2
    inservice
rserver RS_WEB3
    inservice
rserver RS_WEB4
    inservice
sticky ip-netmask 255.255.255.255 address source sticky-ip
replicate sticky
serverfarm SF_FIREGROUP
sticky http-cookie myCookie sticky-cookie
cookie insert browser-expire
serverfarm SF_FIREGROUP
class-map match-any VS_FIREGROUP
2 match virtual-address 10.10.10.169 tcp eq www
4 match virtual-address 10.10.10.169 tcp eq 8081
5 match virtual-address 10.10.10.169 tcp eq 8082
6 match virtual-address 10.10.10.169 tcp eq 8083
7 match virtual-address 10.10.10.169 tcp eq 8084
8 match virtual-address 10.10.10.169 tcp eq 8085
9 match virtual-address 10.10.10.169 tcp eq 8097
class-map match-any VS_FIREGROUP_HTTPS
2 match virtual-address 10.10.10.169 tcp eq https
policy-map type loadbalance first-match HTTP
class class-default
    sticky-serverfarm sticky-cookie
policy-map type loadbalance first-match HTTPS
class class-default
    sticky-serverfarm sticky-ip
policy-map multi-match HTTP_HTTPS_MULTI_MATCH
class VS_FIREGROUP
    loadbalance vip inservice
    loadbalance policy HTTP
    loadbalance vip advertise active
class VS_FIREGROUP_HTTPS
    loadbalance vip inservice
    loadbalance policy HTTPS
    loadbalance vip advertise active
interface vlan 4
bridge-group 1
access-group input INBOUND
service-policy input HTTP_HTTPS_MULTI_MATCH
no shutdown
interface vlan 700
bridge-group 1
access-group input INBOUND
no shutdown
interface bvi 1
ip address 10.10.10.150 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 10.10.10.1
Thanks a lot
Francesco

Hi Francesco,
Just to add more a bit, A bridge group is very similar to routed mode except ACE cannot NAT pass through traffic, vlan's cannot be shared and couple of other things but client's should be able to access the server as in before.
But also whether in bridge or routed mode, ACE does create flows and applies other security parameters if configured to the traffic. This is for security. Also, ACE should know the MAC of the device to forward the traffic to. Can you check if ACE has the MAC of the destination? You can also put a route for testing purpose and see if that resolves the issue. That should probably be the quickest way to check if ACE is creating any issue here.
Regards,
Kanwal

3750 bandwidth limitation between the same vlan over the trunk

Hi All,
I have 2 3750G series switches on the trunk link. some machines are part of vlan1 on the switch 1 and some machines are the part of the same vlan1 on the other switch2. I need to limit the bandwidth between the switches for the vlan1. picture is attached.
I tried to do through the modulare policy frame work (class-map/service-map and policy-map using the police command) but problems are
1) 3750 does not support output service policy, so i cannot apply the policy on the output of the trunk link.
2) I can apply the input policy but it will be only for one machine but not for the others on the same switch. if i apply the policy on per port basis then every port has separate bw limitation. I require to limit the bandwidth on per vlan basis on the trunk port. like vlan 1 takes 10 MB, VLAN2 takes 10 MB on the trunk link when communicating between the same vlans.
Is there any solution for that scenario? your help in this case will be higly appriciated. As its the layer 2 communication, its hard for me to find the solution. if it was layer 3 then i can do it easily by using the rate-limit commmand on the interface.
thanks

On the 4500 series we use vlan-range for this,
conf t
qos aggregate-policer 10MB 10 mbps 1250000 byte conform-action transmit exceed-action drop
policy-map 10MB
class class-default
police aggregate 10MB
interface GigabitEthernet1/1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1,10,12,15
switchport mode trunk
switchport nonegotiate
vlan-range 1
service-policy input 10MB
service-policy output 10MB
end
dunno if the 3750's have the same options

WCS and WLC WLAN Config not fully in sync

Hi,
We're facing the issue WCS and WLC WLAN Config is not fully in sync. WLC showing server 1 is IP:10.160.22.151, Port:1812 but WCS server showing none even after click on “Audit” button. Any idea how to resolve this issue? Is this causing any wireless problem? Attached is screen captured. Thanks for your help.

You mentioned "audit". Have you done a WCS audit so the WLC and WCS are in SYNC?
If you make a change on the WLC you will not see it in WCS UNLESS they are SYNC. You will see the term "mismatch".
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Load balancing within the same ACE across two different contexts residing on the same vlan

I'm working on a design that requires traffic be sent to a different context in the same ACE. The question I have is can this be done when both reside on the same VLAN. Would the traffic in this case be handled at layer 2 instead of layer 7. Would I have to create a seperate subnet in order to provide loadbalancing?
|__________________|
|   | vlan 5         |         |
    |                  |
    |                  |
Context A        |
                       |
                       |
                    Context B
Thanks, Jerilyn

by design, two contexts on the same box in the same vlan can't communicate. You have to use an external L3 device.
A workaround may be to use two diferent vlans and then bridge between them with a loopback cable.

FCIP Peer in the same VLAN

Hi,
I will have 2 data centre connected with a 1gb possibly 2 x 1gb ethernet link.
There will be some 802.q trunking between location and some traffic will be routed.
I have the option of having my FCIP peer in the same vlan and carried in the trunk. Or have them in different VLAN and routed between location.
Initiallay I though routed would be good because I can use QoS to prioritise FCIP traffice.
But could I still achieve this using single vlan. and is it allowed.
both site are connect using 6509 with sup720s
Thanks
John

Hi John,
For the FCIP link it is just an IP connectivity. So, you can do in both ways as you describe. You can route it or use a vlan. Just make sure that you have no too hign RTT. And also there RTT timout setting on FCIP you can play with that according to your RRT in your network.
Thanks,
Hakan.

ACE30_MOD-K9 in bridge mode. Individual servers in the same vlan of rserver not reach.

I configured ACE30-MOD-K9 in bridge mode and I configured a server farm with his real servers. The traffic passes and is balanced correctly between all RSERVER. But I can not contact a server that is on the same vlan of the serverpharm but doesn't belong at this serverfarm.
I Thought that the traffic directed to this "spare" server shouldn't be balanced but the bridge should permit traffic to pass. (trasperent mode) Is it correct ?
What does ACE in bridge mode with traffic directed to servers that do not belong to any server farm but are present on the same VLAN (same bridge group)?
In rispect at the following configuration 10.10.10.168 isn't reacheable
access-list INBOUND line 8 extended permit ip any any
access-list INBOUND line 16 extended permit icmp any any
probe http HTTP_PROBE1
expect status 200 200
rserver host RS_WEB1
ip address 10.10.10.163
inservice
rserver host RS_WEB2
ip address 10.10.10.164
inservice
rserver host RS_WEB3
ip address 10.10.10.165
inservice
rserver host RS_WEB4
ip address 10.10.10.167
inservice
serverfarm host SF_FIREGROUP
rserver RS_WEB1
    inservice
rserver RS_WEB2
    inservice
rserver RS_WEB3
    inservice
rserver RS_WEB4
    inservice
sticky ip-netmask 255.255.255.255 address source sticky-ip
replicate sticky
serverfarm SF_FIREGROUP
sticky http-cookie myCookie sticky-cookie
cookie insert browser-expire
serverfarm SF_FIREGROUP
class-map match-any VS_FIREGROUP
2 match virtual-address 10.10.10.169 tcp eq www
4 match virtual-address 10.10.10.169 tcp eq 8081
5 match virtual-address 10.10.10.169 tcp eq 8082
6 match virtual-address 10.10.10.169 tcp eq 8083
7 match virtual-address 10.10.10.169 tcp eq 8084
8 match virtual-address 10.10.10.169 tcp eq 8085
9 match virtual-address 10.10.10.169 tcp eq 8097
class-map match-any VS_FIREGROUP_HTTPS
2 match virtual-address 10.10.10.169 tcp eq https
policy-map type loadbalance first-match HTTP
class class-default
    sticky-serverfarm sticky-cookie
policy-map type loadbalance first-match HTTPS
class class-default
    sticky-serverfarm sticky-ip
policy-map multi-match HTTP_HTTPS_MULTI_MATCH
class VS_FIREGROUP
    loadbalance vip inservice
    loadbalance policy HTTP
    loadbalance vip advertise active
class VS_FIREGROUP_HTTPS
    loadbalance vip inservice
    loadbalance policy HTTPS
    loadbalance vip advertise active
interface vlan 4
bridge-group 1
access-group input INBOUND
service-policy input HTTP_HTTPS_MULTI_MATCH
no shutdown
interface vlan 700
bridge-group 1
access-group input INBOUND
no shutdown
interface bvi 1
ip address 10.10.10.150 255.255.255.0
no shutdown
ip route 0.0.0.0 0.0.0.0 10.10.10.1
Thanks a lot
Francesco

Hi Francesco,
Just to add more a bit, A bridge group is very similar to routed mode except ACE cannot NAT pass through traffic, vlan's cannot be shared and couple of other things but client's should be able to access the server as in before.
But also whether in bridge or routed mode, ACE does create flows and applies other security parameters if configured to the traffic. This is for security. Also, ACE should know the MAC of the device to forward the traffic to. Can you check if ACE has the MAC of the destination? You can also put a route for testing purpose and see if that resolves the issue. That should probably be the quickest way to check if ACE is creating any issue here.
Regards,
Kanwal

ACE20 Rserver and VIP with the same IP

I have an ACE that I'm trying to get configured. I need a rserver to have the same ip address and a class map vip address. ex below.
rserver host RED
description REDS
ip address 172.95.94.250
inservice
serverfarm host REDS
transparent
rserver RED 9000
lass-map match-all stb-RED
2 match virtual-address 172.95.94.250 255.255.255.0 any
Shouldn't the transparent command under serverfarm allow this configuration? When I issue the class map command I get this error message.
Error: Entered VIP address is not the first address in the VIP range
software version
Software
loader: Version 12.2[121]
system: Version A2(3.6a) [build 3.0(0)A2(3.6a)]
system image file: [LCP] disk0:c6ace-t1k9-mz.A2_3_6a.bin
installed license: no feature license is installed

Hi,
This is correct; you cannot have the VIP and real using the same IP in the config. This will be seen as a Dup IP from the ACE perspective since it owns the VIP IP. How you do this is to configure the server with a unique IP from the subnet configured on the ACE server vlan. This is what you use to define the real in the config. The server IP needs to be L2 adjacent to the ACE for this to work. The transparent keyword tells the ACE to just L2 forward the traffic to the Mac address the real resolves to, but keeps the vip IP as the destination. This is why the server needs to be L2 adjacent to the ACE so that it can see the REALs actual mac address. Without the transparent keyword we NAT the VIP address to the REAL that gets the connections.
You will also need to create a loopback IP using the same address as the vip on the server.
The reason you need to use a loopback IP is so that the server does not arp for this address. You do not want the server to advertise that it owns this address since it is already assigned to the ACE VIP.
The link below is for IOS server load balancing but the loopback samples are still relevant.
http://www.cisco.com/c/en/us/support/docs/routers/7200-series-routers/10567-37.html#topic1
I hope this information is helpful
Best regards
Jim

Hello! I have configured my Wireless network to support bonjour protocol. When I support mDNS in the same Vlan I can see the Apple TV with my iPhone, but I cannot see it with my iPad.

Hello! I have configured my Wireless network to support bonjour protocol. When I support mDNS in the same Vlan I can see the Apple TV with my iPhone, but I cannot see it with my iPad. Someone know if there is any different in the Bonjour protocol between the iPhone and the iPad???
It is like if the iPad changes the process at some point...
Thank you!

You don't need to configure anything specific for it to work unless you had some special filtering in place already.
What do you mean specificly by can not "see" it with your iPad?

Location Appliance 2700 - is it supported with v7 WCS and WLC?

The compatibility matrix shows no support for a Location Appliance 2700 for any version 7.0.x.x for WCS and WLC. However, I did see a thread here where a v6.0.x.0 had compatibility. v6.0.202.0 is MD. Is it compatible with v7 WCS and WLC?
Can any of the experts please comment? Thank you.

Hi,
here is the link that will answer ur question!!
http://www.cisco.com/en/US/docs/wireless/controller/4400/tech_notes/Wireless_Software_Compatibility_Matrix.html#wp78062
Please dont forget to rate the usefull posts!!
Regards
Surendra

WCS and WLC, On the same VLAN ?

Similar Messages

Maybe you are looking for