Wireless Bridge - Leap or WPA

I have a wireless bridge setup to use LEAP. On rare occasion, the bridge communication will fail. The LEAP authentication will fail. I have to remotely reset the root AP. Can WPA be used with shared-keys to safely secure the bridge communication.
The wireless bridge is using 350BR radios.
Thanks,
Dan Laden

Hi Dan,
WPA is added to the new IOS version but the latest VxWorks based versions do not have it yet. This means you can not run WPA on a BR350 yet.
If the radio link fails then the non root bridge will try to associate to the root when the link is fixed, you should no have to reload the root for this.
What firmware version you using on both ends ??
try the EAP debugs and see why it is failing before you reload the root, it sounds like you have another problem there also.
David

Similar Messages

Wireless bridge with WPA

I want to add my wireless interface wlan0 to a bridge br0. But
brctl addif br0 wlan0
doesn't support this operation. I searched online and tried with 4addr mode enabled. Then the above code works but my wireless NIC cannot associate with the AP using wpa_supplicant.
Could anyone help me explain this? What's the relationship between wireless bridge, 4addr mode and wpa_supplicant?
Any other solution which can add wlan0 to br0 and associate it with AP using WPA is also welcome. Thank you!
Last edited by cyker (2012-11-23 21:00:01)

Assuming you want to have the Wireless interface be the GW....
Instead directly connect the wireless interface to the bridge device,
You could use iptables to forward and NAT traffic between wlan0 and br0
Something like.
Connect to the wireless network like you normally would.
Then I guess you have a network of VM's on the bridge?, so...
echo 1 > /proc/sys/net/ipv4/ip_forward
brctl addif br0 eth0
brctl addif br0 tap0
brctl addif br0 tap1
ifconfig br0 10.0.0.1 netmask 255.255.255.0 up
iptables -A FORWARD -i wlan0 -o br0 -s 10.0.0.0/24 -m state --state NEW -j ACCEPT
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A POSTROUTING -t nat -j MASQUERADE
I used that config to route hosts connected to my eth0 interface to the Internet through my wlan0 interface. ( i.e. there was no 'br0' in the iptables config instead it was 'eth0')
With that config, the Hosts on eth0, tap0, and tap1 will have their default GW be 10.0.0.1 and the Archlinux/router/computer/laptop in the middle will have a default gw of whatever the wlan0's GW is.
Last edited by hunterthomson (2012-11-27 10:28:50)

Will the 340 wireless bridge support Leap

Will the 340 point to point wireless bridge authenicate and use Leap if upgraded to the latest software, like the 350 series bridges? The documentation is not clear on this.

NO,
They run a different operating system and were end of lifed before LEAP.
The documentation is a little vauge on this topic if you are not familar with all of the product range, but what youare looking in the documentation for is.
To run LEAP you will see you need newer than 11.0 firmware.
The BR340's firmware is 8.x

Need Help using WRT54GL as Wireless Bridge for Xbox

Hi.
I need help configuring my WRT54GL as a wireless bridge for my xbox.
I have a Billion BiPAC 7404VGO currently in service as my main router/modem. i.e. I have my ADSL connection and PC connected to this. I also connect to this with a laptop.
I have an original xbox at the other end of the house (cat5 NOT an option).
Basically I want to connect my xbox to the rest of network. I have a WRT54GL I can use for this. I just dont know how to set it up.
The WRT54GL has Firmware Version: v4.30.7 (out of the box).
My Wireless network is using WPA.
I have a VPN setup through to work via the Billion.
The idea is to stream media from my PC to the xbox (media centre).
Any help would be HUGELY appreciated.
Thanks in advance.
Katman

A wireless router is a device which requires its own wired internet connection. A wireless router is not a wireless access point like the Linksys WAPs. A wireless router does not connect wireless to other wireless routers/APs with standard Linksys firmware. With Linksys firmware you need a WAP54G or similar. The WAPs support wireless bridging and repeater mode.
If you already have a WRT54GL then you have to install a 3rd party firmware which adds wireless bridging capabilities. Read the wikipedia article on "WRT54G" for information about which WRT models support 3rd party firmware and an overview of projects and links.
Remember, however, that you may brick your router if you install a 3rd party firmware incorrectly and you probably void the warranty if you install 3rd party firmware (it is even possible to find out after you restore the original Linksys firmware if you don't clear the NVRAM before).

Wireless Bridge Aironet 1240

Hi all,
is it possible to create a wireless bridge between 2 AP of different brands?
I need to create a bridge between an Aironet 1240 and a Telecom Italia router (Alice Gate VoIP 2 Plus Wi-Fi), where
the Alice Gate is the AP and the aironet works in the workgroup mode.
At home I tried with the Aironet and a Thomson st585: when aironet tries to connect to the ssid, the thomson ap reloads.
In Aironet logs I find : "Parent lost : too many requests"
What does it mean?

dancampb is right. There isn't a standard for wireless bridging so interoperability between vendors is very low.
I have tried the following 3 tests.
1. Set Cisco Aironet 1242 as the root AP and Cisco Aironet 1231 as the wireless work bridge. No problem with all encryption methods like WEP, WPA WPA2.
2. Set Linksys WRT310N as the root AP and Cisco Aironet 1242 as the wireless work bridge. Tried WPA2, can't associate.
3. Set Belkin54g as the root AP and Cisco Aironet 1231 as the wireless work bridge/repeater. Open method, can't associate.
As far as I know, if you can flash both the AP and the Bridge with the same firmware like DD-WRT, then you have a big chance to successfully associate them.
Hope the above tests help.

Can't get working as wireless bridge - help!

Folks I am trying to setuy my base station as a wireless bridge to ultimately connect to a network printer. I try to first connect it to my wireless network form my netopia dsl wireless router, but am having no success. Here's what doesn't make sense:
- my base station won't recognize any wireless networks in the area unless I have my Macbook Pro's built-in airport turned on. This makes no sense - what if I had no built in card
- the airport extreme doesn't ask for any WEP or WPA type security to connect to my wireless network. It just asks for a password.
I am at my wits end with this base station. Netopia bridges ares so much easier to configure. Can anyone please give me some guidance.
I just want to have the base station see networks to begin with, let me choose the one I want, provide it the necessary WEP password key for my network, and then plug it into the ethernet port of my printer.

Let's double-check your AirPort Extreme Base Station's (AEBS) bridge configuration settings ...
To set up the AirPort Extreme Base Station (AEBS) as a bridge, temporarily connect your computer directly (using an Ethernet cable) to the LAN port of the AEBS, and then, using the AirPort Admin Utility (found in /Applications/Utilities), make these settings:
Network tab
o Distribute IP addresses (unchecked)
o Apply the new settings.
In a bridge configuration, the AEBS must be connected to the Netopia DSL wireless router via an Ethernet cable. This is NOT that same as the AirPort Express Base Station (AX) which has the option to connect to an existing wireless network as a client.

DHCP over wireless bridge

I want to setup a wireless bridge going from a current network (siteA), to a new small network across the street (siteB). I have 2 Cisco 1131AG Access points. I have no need for any client access, only the bridge. I have the interfaces up and can ping across, however, no dhcp requests seem to come over the bridge. Where am I going wrong??
[SiteA]
dot11 ssid Cisco
authentication open
authentication key-management wpa
guest-mode
infrastructure-ssid
wpa-psk ascii secret
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption mode ciphers aes-ccm
ssid Cisco
station-role root access-point
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
interface BVI1
ip address 10.175.36.254 255.255.255.0
no ip route-cache
bridge 1 route ip
[SiteB]
dot11 ssid Cisco
authentication open
authentication key-management wpa
guest-mode
wpa-psk ascii secret
bridge irb
interface Dot11Radio0
no ip address
no ip route-cache
encryption mode ciphers aes-ccm
ssid Cisco
station-role workgroup-bridge
bridge-group 1
bridge-group 1 spanning-disabled
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
interface BVI1
ip address 10.175.36.253 255.255.255.0
no ip route-cache
bridge 1 route ip
bridge 1 aging-time 120

Have you tried configuring Site A as root bridge and Site B as non-root bridge.
See this example:
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a008058f53e.shtml

Non-root wireless bridge speed issue

I have a wireless bridge connecting two buildings, using Cisco Aironet 1262's. The root Bridge allows for bonding 2 channels on the A radios and talks at 40MHz, the non-root does not alloow me to do this configuration in the gui, and the band width is only 20MHz. So one side of my bridge will talk at a higher rate then the other end. Any ideas, suggestions??
Product/Model Number:
AIR-LAP1262N-A-K9
Top Assembly Serial Number:
FTX1449S3B4
System Software Filename:
ap3g1-k9w7-xx.152-2.JA
System Software Version:
12.4(25d)JA
Bootloader Version:
12.4(23c)JA
System Uptime:
29 minutes

So here is the thing. Just remember that wireless is half duplex so if your connecting at 54mbps, your max throughput would be half of that so around 22.5mbps which you are seeing. Now if you wanted to maybe connect at 802.11n rates (might or might not) make sure you are using either open authentication or WPA2/AES. These are supported in the 802.11n standard.
http://www.cisco.com/en/US/docs/wireless/access_point/ios/release/notes/12_4_25d._JArn.html#wp291685
802.11n HT Rates Apply Only to No Encryption or WPA2/AES Encryption
The 802.11n HT rates apply only to no encryption or WPA2/AES encryption. They do not apply to WEP or WPA encryption. If WEP or TKIP encryption is used, the 1250 series access points and any 802.11n Draft 2.0 clients will not transmit at the HT rates. Legacy rates (802.11a/b/g) will be used for any clients using WEP or TKIP encryption
Sent from Cisco Technical Support iPhone App

Help connecting emac to Router via Belkin Wireless Bridge FSD7330

Dear All,
I've been given an old emac without an Airport card and would like to connect it to my Netgear WGR614v9 wireless router which I run two XP laptops through.
I've been told that I need a wireless bridge so have bought the Belkin FSD7330. Unfortunately there appears to be no mac software or drivers with either installation cd, despite the manufacturers saying they'll work with macs and I'm out of ideas...
The emac connects fine to the internet when hardwired to the router but won't seem to pick up the router or bridge wirelessly... Can anyone give me an idiots guide on how to get started please?
Any help gratefully received! Many thanks

Hello,
As Allan already indicated, no special software is needed for a (configured) wireless Ethernet bridge; you can use it with a Mac or a PC.
There are different versions of the F5D7330 (one or two antennas; colour). Various variants are mentioned at Belkin's UK support centre web site.
Have a look at this web page regarding firmware. For example, the 1.00.09 version will update applicable units sold with only WEP security to WPA (the use of which is a good idea). You will need a PC to carry out firmware updates.
Generally speaking, do not run any (PC) setup wizard software from a supplied CD. Instead, make use of the web-based interface. You should be able to run a browser on a Mac or a PC, but the pages may not look the same everywhere (if there is a problem with one browser, try another).
If necessary, a manual can be downloaded from the support centre. Use the instructions for setting up the F5D7330 wireless Ethernet bridge in an "infrastructure" mode. The security configuration page displayed after a firmware update (to WPA) may differ a bit from the information in the manual. WPA is normally easier to set up than WEP.
Jan

Low throughput over wireless bridge with two WRT160N

I recently bought two Linksys WRT160Ns and created a wireless bridge according to http://www.dd-wrt.com/wiki/index.php/Wireless_Bridge. I installed DD-WRT v24-sp1 (07/27/08) min.
But, in a perfect setting where both devices are just a meter apart I can only get a throughput of 20Mbps when using security (either WEP or WPA) or 30Mbps if using no security at all. To measure this I'm transferring a large file from one computer to the other and checking the result on the "bandwidth" page of the router.
Any suggestions on how to improve the bandwidth would be much appreciated!
Thanks, Gordan

Ask in a dd-wrt forum. They know how to tweak their firmware.

Wireless Bridge for gaming

I am using an Airport Express to create a wireless network in my home, with WPA/WPA2 encryption.
I would like to buy a wireless bridge so I can connect to the internet on my Playstation 2 and play games.
Does anyone know of a good wireless bridge for this purpose? One that can be used with WPA/WPA2 encryption.

What is your router brand?
I believe some router can be tweak using its web based interface to dedicated bandwidth for gaming.
Are you using wireless for gaming, maybe if you step up to N protocol, it might help you too. But you have to get wireleen N router and have macbook that capable with wireless N protocol.
If you using wired online gaming, consider one with gigabit port.
Good Luck

Enable AES encryption on 1310 Wireless bridge

Hi All,
I have requirment to enable the AES encryption on the management VLAN traffic between connected root and non root bridges . can any one share the configuration guidelines please ??
below is the network setup .
Router<---->SW1 ( main office)--> Root-bridge < ---------->non root-bride------SW2 ( remote end site)
Apart from the specific configuration on the wireless bridge is any extra configuration required on the Switch interfaces??
Regards
Lerner

Hello,
1. Make sure you are running version 12.3(7)JA or later since WPA2/AES was not always available for the 1310.
2. How do you currently have the root/non-root configured?
Ideally, adding AES shoudl be fairly straight forward. Keep in mind we recommend using WPA2 with AES.
configured on your root AND non-root:
dot11 ssid
authentication open
authentication key-management wpa version 2
interface do1
encryption mode ciphers aes-ccm

Wireless bridging w AP1220Bs

hi,
is wireless bridging possible with 2 units of AP1220Bs (one on IOS, the other on VxWorks)?
as i am getting the following errors:
<ap.ios# show logs> [set to non root bridge]
Mar 1 00:00:18.590: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associa
te: no wpa-v1 v2 chk needed
*Mar 1 00:00:40.590: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associa
te: Rcvd response from xxxx.xxxx.xxxx channel 1 2858
*Mar 1 00:14:07.589: %DOT11-4-CANT_ASSOC: Interface Dot11Radio0, cannot associa
te: Associating
ap#
<ap.vxworks# logs> [set to root ap]
Station aabbccddeeff Failed Association, status "Can Not Support All Requested Capabilities"
any ideas?

i think it seems to work after i have change the ap1220b (ios) to operate as WGB.
anyway, thanks for the suggestion. i dont think i can upgrade as,
a> those ap are loan equipment
b> neither do i have any cco account to obtain the software (requires some image software, if i have not mis-read the upgrade guide)

Connectivity Issues with 1400 Wireless Bridge

Just seeing if anyone has run into a similar problem....I have two 1400 outdoor wireless bridges. They have been in place for a couple of years without issue. This past week, the non-root bridge began dropping it's association, at first randomly, then consistently. Both bridges have been replaced, antennas (AIR-ANT58G10SSA-N) on both have been replaced, and a spectrum analyzer has been used to verify there is not a problem over the air...the ditance between the two is >=1000 feet. Debugs show no reason for the drop, and when the two are asscoaited, the RSSI is averaging around -78. It had been down since Thursday, then last night, as another step in the process of elimination, we replaced the power injector on the root side, and the two bridges associated. They were up for two hours, then went down again, and then started going up and down randomly. As an additional step in the process of elimnation, we are now going to move the power source that the PI is connected to. Anyone ever run into something similar before or have any additional ideas? Thanks in advance.
Below is the most information I can glean from the logs
*Mar 1 06:31:39 pst: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP KAirBridge_Para 0019.566e.be47 [None WPA PSK]
*Mar 1 06:31:39 pst: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
*Mar 1 06:31:41 pst: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Received deauthenticate (2) not valid
*Mar 1 06:31:41 pst: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to down
*Mar 1 06:31:42 pst: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP KAirBridge_Para 0019.566e.be47 [None WPA PSK]
*Mar 1 06:31:42 pst: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up
*Mar 1 06:32:05 pst: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Received deauthenticate (2) not valid
*Mar 1 06:32:05 pst: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to down

Yeah, power save is off, the cable run is only about 20 feet. The radio interface was shut down last night so that alerts weren't generated through the night due to flapping, I opened the interface earlier and right now both are up and have been for about an hour. I agree, -78 is not a great signal...currently, looking at the association, the root is at -64 and the non-root is at -62...will update if there is a status change. Thanks.

Wireless Bridge Resilient Trunk Link

Hi Community folk,
I need some advice on how to set up a dual (resilient) wireless bridge link.

I have each pair of bridges configured trunking vlan 82 native and user vlan 570. Individually they are fine and I get management access on vlan 82 to both bridges and the switch at the remote end of the link, clients patched in to the switch at the remote end in switchport access vlan 570 also get the correct IP address and subsequent access to network resources, individually they are working well. rapid pvst is configured across the network as there are dual 1Gb connections to all access layer switches and this also works fine. My problem is when I enable the second bridge link, this seems to cause a network loop and essentially takes down the whole network, I have left it for a while to see if spanning tree convergence is taking a while but no luck, as soon as I disable the second link everything calms down and I have a good network again. I am posting my root and non-root bridge configurations here but only one of the pairs, the other pair is configured identically but has a different SSID, PSK and channel configured:
ROOT BRIDGE********************************
dot11 syslog
dot11 vlan-name Legacy_Data vlan 570
dot11 vlan-name management vlan 82
dot11 ssid test
vlan 82
authentication open
authentication key-management wpa version 2
infrastructure-ssid
wpa-psk ascii XXXXXXXXXXXXXXX
interface Dot11Radio1
no ip address
no ip route-cache
encryption mode ciphers aes-ccm tkip
encryption vlan 82 mode ciphers aes-ccm tkip
ssid test
antenna gain 0
peakdetect
no dfs band block
stbc
channel width 40-below
channel 5280
station-role root bridge
world-mode dot11d country-code GB outdoor
infrastructure-client
interface Dot11Radio1.82
encapsulation dot1Q 82 native
no ip route-cache
no cdp enable
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
interface Dot11Radio1.570
encapsulation dot1Q 570
no ip route-cache
no cdp enable
bridge-group 70
bridge-group 70 subscriber-loop-control
bridge-group 70 spanning-disabled
bridge-group 70 block-unknown-source
no bridge-group 70 source-learning
no bridge-group 70 unicast-flooding
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
interface GigabitEthernet0.82
encapsulation dot1Q 82 native
no ip route-cache
bridge-group 1
bridge-group 1 spanning-disabled
no bridge-group 1 source-learning
interface GigabitEthernet0.570
encapsulation dot1Q 570
no ip route-cache
bridge-group 70
bridge-group 70 spanning-disabled
no bridge-group 70 source-learning
interface BVI1
mac-address xxxx.xxxx.xxxx
ip address 10.xx.xx.xx 255.255.255.0
no ip route-cache
ip default-gateway 10.xx.xx.xx
ip forward-protocol nd
ip http server
no ip http secure-server
bridge 1 priority 9000
bridge 1 protocol ieee
bridge 1 route ip
bridge 70 priority 10000
bridge 70 protocol ieee
line con 0
line vty 0 4
transport input all
end
NON ROOT BRIDGE************************************************************************************
dot11 syslog
dot11 vlan-name Legacy_Data vlan 570
dot11 vlan-name management vlan 82
dot11 ssid test
vlan 82
authentication open
authentication key-management wpa version 2
infrastructure-ssid
wpa-psk ascii xxxxxxxxxxxxxxx
interface Dot11Radio1
no ip address
no ip route-cache
encryption mode ciphers aes-ccm tkip
encryption vlan 82 mode ciphers aes-ccm tkip
ssid test
antenna gain 0
peakdetect
stbc
station-role non-root bridge
world-mode dot11d country-code GB outdoor
interface Dot11Radio1.82
encapsulation dot1Q 82 native
no ip route-cache
no cdp enable
bridge-group 1
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
interface Dot11Radio1.570
encapsulation dot1Q 570
no ip route-cache
no cdp enable
bridge-group 70
bridge-group 70
bridge-group 70 subscriber-loop-control
bridge-group 70 spanning-disabled
bridge-group 70 block-unknown-source
no bridge-group 70 source-learning
no bridge-group 70 unicast-flooding
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
interface GigabitEthernet0.82
encapsulation dot1Q 82 native
no ip route-cache
bridge-group 1
bridge-group 1 spanning-disabled
no bridge-group 1 source-learning
interface GigabitEthernet0.570
encapsulation dot1Q 570
no ip route-cache
bridge-group 70
bridge-group 70 spanning-disabled
no bridge-group 70 source-learning
interface BVI1
mac-address xxxx.xxxx.xxxx
ip address 10.xx.xx.xx 255.255.255.0
no ip route-cache
ip default-gateway 10.xx.xx.xx
ip forward-protocol nd
ip http server
no ip http secure-server
bridge 1 priority 10000
bridge 1 protocol ieee
bridge 1 route ip
bridge 70 priority 12000
bridge 70 protocol ieee
line con 0
line vty 0 4
transport input all
end
Switchport Configurations****************************************************
interface FastEthernet0/23
description Link to root bridge 1
switchport trunk native vlan 82
switchport trunk allowed vlan 82,570
switchport mode trunk
interface FastEthernet0/24
description Link to root bridge 2
switchport trunk native vlan 82
switchport trunk allowed vlan 82,570
switchport mode trunk
BR
Rockford

Hi Rockford,
This should be possible. Check the primary switch set to spanning tree root for your vlans & two different bridges connected ports having different STP port priority for vlan 82 & 570.
Since you are having STP loop I think ports get shutdown.
In case if could have L3 seperation between these two buildings, then you can load balance traffic between those two radio links. Here is a reference post which I posted some tested config for that scenario.
https://supportforums.cisco.com/discussion/12041146/good-solution
If I get time I'll see whether I can do similar thing for your config requirement
HTH
Rasika
**** Pls rate all useful responses ****

Wireless Bridge - Leap or WPA

Similar Messages

Maybe you are looking for