WiSM interface vlan requirement

Can anyone tell me why the AP-Manager and Management interfaces have to be on the same VLAN? I'm probably missing something about WiSM operations but if I'd appreciate the input.
thanks
js

That is the only supported way. Any other way will not work. This goes for any WLC configuration and not just the WiSM. The management interface so you can manange the wlc it is aslo the defaut interface used when an ap first joins the wlc and then the ap-manager is used for the lwapp tunnel. If you have the management and ap-manager interfaces on a different subnet, then you will see a vlan mismatch on the switch. Also it is important to note that both these interfaces need to be native vlan on the trunk port.

Similar Messages

WiSM - Interface Vlan Overlapping within AP Group

Hi there,
Need help on this. Wism that deployed on the network had found issue in interface vlan overlapping. Had configured the vlan interface and assign to a group. The group had been define on specific lwapp APs. However user that manage to associate with the particular AP had used the different group that not specify to that APs. It had been using the group that been specify to other APs that located at different location.
Any ideas on this? Is this internal bugs? I had checked with the bugs listed in Cisco software. But not mentioned about this. Fyi, we are running on software version 4.1.171.0. and also we are operates almost of 80 Aps under 40 interface vlan assign to the groups.

Could you provide the details of the wism configuration?

WISM Interface

Hello
I am having trouble to upgrade our Catalyst 6509 from s72033-ipservicesk9-mz.122-33.SXH4.bin to 72033-ipservicesk9-mz.122-33.SXJ1.bin. I am upgrading because of installation of a WISM2 controller.
The Catalyst configuration is:
1   10 WiSM WLAN Service Module               WS-SVC-WISM-1-K9
2   10 WiSM WLAN Service Module               WS-SVC-WISM-1-K9
3   10 WiSM WLAN Service Module               WS-SVC-WISM-1-K9
4   6 Firewall Module                                            WS-SVC-FWM-1
5   2 Supervisor Engine 720 (Active)         WS-SUP720-BASE
7   24 CEF720 24 port 1000mb SFP             WS-X6724-SFP
The problem is with our WISM controllers, when rebooting with the new IOS 122.33.SXJ
The interface configuration in startup-config is erased completely for all WISM interface.
interface GigabitEthernet1/1
description WISM A
switchport
switchport trunk encapsulation dot1q
switchport trunk native vlan 4060
switchport trunk allowed vlan 780-788
switchport mode trunk
no snmp trap link-status
no cdp enable
channel-group 8 mode on
The only way to keep the Interface konfuguration is witch IOS s72033-ipservicesk9-mz.122-33.SXH4.bin.
Regards
Johan

Johan,
We introduced the auto-configuration wism commands starting in 12.2(18)SXF5, and in the SXI code and later (SXJ included) it is now the only way to configure the WISM modules.
If you were previously using the manual port configuration, you will need to migrate to the new set of wism commands:
http://www.cisco.com/en/US/products/hw/modules/ps2706/products_tech_note09186a00808330a9.shtml#config
wism module controller <1/2> native-vlan x
wism module controller <1/2> allowed-vlan x,y,z...
-Patrick Croak
Wireless TAC

Policy-map input on an interface VLAN

Hi there,
I have a problem with a policy-map on an interface VLAN on my Cisco 6509-E.
The switch has the IOS Version 12.2(33)SXI10, RELEASE SOFTWARE (fc2).
I have configured this policy-map:
policy-map PM-10Mbit
class class-default
   police cir 10000000 bc 1875000 be 3750000    conform-action transmit     exceed-action drop     violate-action drop
I bind this map on a physical interface
interface GigabitEthernet2/2
description <removed>
ip vrf forwarding <removed>
ip address <removed>
ip access-group <removed> out
service-policy input PM-10Mbit
service-policy output PM-10Mbit
and get this result:
show policy-map interface
GigabitEthernet2/2
Service-policy input: PM-10Mbit
    class-map: class-default (match-any)
      Match: any
      police :
        10000000 bps 1875000 limit 1875000 extended limit
      Earl in slot 5 :
        6428065284 bytes
        5 minute offered rate 14696 bps
        aggregate-forwarded 6294160565 bytes action: transmit
        exceeded 133904719 bytes action: drop
        aggregate-forward 584 bps exceed 0 bps
Service-policy output: PM-10Mbit
    class-map: class-default (match-any)
      Match: any
      police :
        10000000 bps 1875000 limit 1875000 extended limit
      Earl in slot 4 :
        10335145381 bytes
        5 minute offered rate 21536 bps
        aggregate-forwarded 10142894661 bytes action: transmit
        exceeded 192250720 bytes action: drop
        aggregate-forward 128 bps exceed 0 bps
      Earl in slot 5 :
        263335780 bytes
        5 minute offered rate 176 bps
        aggregate-forwarded 263335780 bytes action: transmit
        exceeded 0 bytes action: drop
        aggregate-forward 448 bps exceed 0 bps
But when I bind it on an interface VLAN i see no incoming traffic:
show policy-map interface
Vlan1012
Service-policy input: PM-100Mbit
    class-map: class-default (match-any)
      Match: any
      police :
        100000000 bps 18750000 limit 18750000 extended limit
      Earl in slot 4 :
        0 bytes
        30 second offered rate 0 bps
        aggregate-forwarded 0 bytes action: transmit
        exceeded 0 bytes action: drop
        aggregate-forward 0 bps exceed 0 bps
      Earl in slot 5 :
        0 bytes
        30 second offered rate 0 bps
        aggregate-forwarded 0 bytes action: transmit
        exceeded 0 bytes action: drop
        aggregate-forward 0 bps exceed 0 bps
Service-policy output: PM-100Mbit
    class-map: class-default (match-any)
      Match: any
      police :
        100000000 bps 18750000 limit 18750000 extended limit
      Earl in slot 4 :
        1005376843668 bytes
        30 second offered rate 33016448 bps
        aggregate-forwarded 1005362388151 bytes action: transmit
        exceeded 14455517 bytes action: drop
        aggregate-forward 30943792 bps exceed 0 bps
      Earl in slot 5 :
        1828318775 bytes
        30 second offered rate 1296 bps
        aggregate-forwarded 1828318775 bytes action: transmit
        exceeded 0 bytes action: drop
        aggregate-forward 1272 bps exceed 0 bps
Is this a bug or am I doing something wrong here?

Hello
As I understand it , this is command is required in mls qos because on a SVI ( L3 vlan interface) runs in a vlan-based mode which differs from normal L3 routed interfaces which run in interface mode.
As per cisco ="In VLAN-based mode, the policy map that is attached to the Layer 2 interface is ignored, and QoS is driven by the policy map that is attached to the corresponding VLAN interface."
Lastly regards
Try matching on all traffic incoming on the trunk interface on that switch for it to successfully police incoming traffic:
class-map V102
match input-interface x/x
Policy-map POLICE
class V102
Police xxxx xxxx
res
Paul

SG300/SG500 remove interface vlan

Hello!
The issue is following:
I add an vlan interface for testing IP connectivity in this vlan by adding an IP to this vlan interface and ping an host.
eg
interface vlan 5
ip address 192.168.0.251 255.255.255.0
Afterwards i can remove the ip address with "no ip address", but I can't remove the "interface vlan 5".
Even when i delete the vlan itself from the vlan database. There is no "no interface vlan" command. I only can shutdown the vlan interface.
So does anybody know, how to remove vlan interfaces from the cli of SG300/SG500 switches.
Thanks, Woeger

Hello,
I just attempted this with my lab switch here.
I created VLAN 10 and gave it an IP address.
Then I did a no ip address on the VLAN interface, and then a no vlan 10.
At this point there is no interface VLAN 10 listed in my running config or when I do a show ip interface.
So removing the VLAN did actually delete the interface for me, which brings me to my question.
Which version of the firmware/bootcode are you currently using? It may be that this has been fixed, because I am currently running 1.3.7.18 firmware with 1.3.7.01 bootcode.
If you are on a lower one go ahead and upgrade it, remember to upgrade the bootcode as well, it is required for the newer firmware versions.
Hope that helps, but if not just let me know and we can take another look,
Christopher Ebert - Advanced Network Support Engineer
Cisco Small Business Support Center
*please rate helpful posts*

Interface vlan does not up!

Hi all,
I create a vlan follows an interface vlan, but the interface vlan does not up.
I'm using RSP7600 Adv IP Service with ES20 line card. Please help.
Thanks million!

Hello,
A SVI interface for a VLAN X will be up/up if there is an access port alive in the VLAN X on the switch, or if there is a trunk port alive on the switch on which the VLAN X is allowed. Are these requirements met in your particular case?
Best regards,
Peter

Interface Vlan is not installed in routing table

Dear All,
Today I faced a strange problem and I want to share it with you to find what is the problem ?
we have a VRF for one customer and we use interface vlan to define customer's branch.
The customer interface is VLAN 422 and it is defined under customer VRF probably .
PE#sh running-config vrf V3056:RIYADHBANK
Building configuration...
Current configuration : 1321 bytes
ip vrf V3056:RIYADHBANK
rd 65000:3887
maximum routes 1400 80
route-target export 65000:5405
route-target import 65000:5405
route-target import 65000:5406
interface Vlan422
description By *****
ip vrf forwarding V3056:RIYADHBANK
ip address 172.29.12.97 255.255.255.252
service-policy input 2M_IN
PE#sh vlan id 422
VLAN Name Status Ports
422 422 active Gi3/0/11 efp_id 422
VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2
422 enet 100422 1500 - - - - - 0 0
Remote SPAN VLAN
Disabled
Primary Secondary Type Ports
PE#
we can see the interface vlan is up
PE-L3Agg-Khu-107-2#sh int vlan 422 description
Interface Status Protocol Description
Vl422 up up ****
PE#
and we can see the vlan 422 belongs to the correct VRF
PE#sh vrf V3056:RIYADHBANK
Name Default RD Protocols Interfaces
V3056:RIYADHBANK 65000:3887 ipv4 Vl627
Vl775
Vl422
PE#
when we tried to troubleshoot the customer routing we found :
PE-L3Agg-Khu-107-2#ping vrf V3056:RIYADHBANK 172.29.12.97
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.29.12.97, timeout is 2 seconds:
Success rate is 0 percent (0/5)
PE-#
we could not ping the ip address of interface vlan 422.
PE#sh ip route vrf V3056:RIYADHBANK 172.29.12.97
Routing Table: V3056:RIYADHBANK
% Subnet not in table
PE#
PE#show ip route vrf V3056:RIYADHBANK connected
Routing Table: V3056:RIYADHBANK
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
+ - replicated route, % - next hop override
Gateway of last resort is 192.168.111.16 to network 0.0.0.0
172.29.0.0/16 is variably subnetted, 338 subnets, 2 masks
C 172.29.12.44/30 is directly connected, Vlan627
L 172.29.12.45/32 is directly connected, Vlan627
PE-L3Agg-Khu-107-2#
PE-L3Agg-Khu-107-2#
My question is: Why the interface vlan 422 is not installed in VRF Table as it is UP ??
thanks in advance!
Rashed Wardi.

what platform is this? can you please paste the output of show version and show run?
Also when you tested this was int Gi3/0/11 up/up?
Best Regards,
Bheem

WLC 5508 , AP client dhcp address different from WLAN interface VLAN subnet?

Hope the title makes sense, here's my situation: I have multiple businesses on 1 WLC 5508, there's a LAG to my core switch with seperate interfaces for each, broken up by vlans.
My question is: if i have a WLAN setup to use interface "Company A" which is vlan 10 with an ip of 10.0.1.5 which then points to 10.0.1.10 for dhcp.
Can the WLAN client connecting to the Company A WLAN use an IP in a different IP range?(192.168.1.10?) can the wlc route? from the perspective of the DHCP server where doers the request come from? (10.0.1.5?)
Can the DHCP server 10.0.10.10 on vlan 10 respond back with and ip on a different subnet to assign to the client to use and still be fully fonctioning? would the default gateway for the client need to be 10.0.1.5? So the clients ip would be 192.168.1.10 /24 with a gateway of 10.0.1.5 (ip adress fo vlan10 interface on WLC) And if multiple clients on the same subnet wanted to talk to each other woudl the WLC know how to route them to each other without passing through the default gateway?
Sorry if this is confusing I'm having a bit of a hard time explaining it in works, i can try and draw somethign up if it makes more sense.
thanks
Eric

I think if you want these clients to stick to a WLAN configured on a VLAN that has a different IP addressing you could configure your VLAN with the normal IP addressing then add on the SVI the 2nd IP_Class_default_gateway.
E.G.
Vlan 10
interface vlan 10
ip address 10.0.10.1 255.255.255.0
ip address 192.168.1.1 255.255.255.0 secondary
Clients that receive IP address from 192.168.1.0/24 network will be able to reach 192.168.1.1 and all traffic will pass right.

How to exclude the monitoring (device avaibility) on an interface vlan?

Hello All,
How can i exclude the monitoring on an "intervace vlan"
My switch 3750X have many interface vlan , LMS 4.2.2 discover the device and have an automatic poller that test the reachability on the IP for these interface vlan.
And i have many Critical alarmes when the interface vlan is down, because no end host are in this vlan
(Operationaly Down, Unresponsive).
Thank you.
Alain Pernelle.

Hello pkr_legend,
Take a look at these symptoms and see if the troubleshooting steps help to resolve your issues. Please let me know.
Good luck!
↙-----------How do I give Kudos?| How do I mark a post as Solved? ----------------↓

Interface vlan - ACL - pinging issues.

I'm trying to understand why an ACL which is applied to an interface vlan is affecting the traffic for a different interface vlan.
Both vlans are configured on the same device and there's a trunk connecting the "access" switch to the "distribution" switch.
so, what we have is:
UD-1 UD-1B
UA
Int vlan are configured in both UDs and the vlan is allowed in the trunk that connects the UD to the UA.
There's an ACL blocking traffic to the int vlan 225 ip that is configured in the UA, but there's no ACL on the vlan 185 (the same IP that Im trying to ping).
So , why is this happening?
configs:
UD-1A:
interface Vlan185
ip address 10.8.185.3 255.255.255.0
interface Vlan225
ip address 10.18.225.3 255.255.255.0
ip access-group ud1 in
int gi1/1
interface GigabitEthernet1/1
switchport trunk encapsulation dot1q
switchport trunk native vlan 225
switchport trunk allowed vlan 185,225
switchport mode trunk
UD-1B
interface Vlan185
ip address 10.8.185.4 255.255.255.0
interface Vlan225
ip address 10.18.225.4 255.255.255.0
ip access-group al_rpf_sre_ud1_pro in
interface GigabitEthernet4/4
switchport trunk encapsulation dot1q
switchport trunk native vlan 225
switchport trunk allowed vlan 185,225
switchport mode trunk
interface Vlan185
ip address 10.8.185.7 255.255.255.0
ip access-group ro in
interface GigabitEthernet1/1
switchport trunk encapsulation dot1q
switchport trunk native vlan 225
switchport trunk allowed vlan 185,225
switchport mode trunk
interface GigabitEthernet1/2
switchport trunk encapsulation dot1q
switchport trunk native vlan 225
switchport trunk allowed vlan 185,225
switchport mode trunk
so, when I ping 10.8.185.7
I get:
GMT-3: ICMP: dst (10.8.185.7) administratively prohibited unreachable rcv from 10.8.185.4
%SEC-6-IPACCESSLOGDP: list ud1 denied icmp 10.8.185.7 (GigabitEthernet1/1) -> 10.18.232.58 (0/0), 3 packets
anybody?

Hello Paresh,
thanks for replying.
But, actually I dont think this is what happening.
Because 10.18.232.58 comes from an uplink - core router, which enters from a different interface.
Let me give you the configs:
uplinks:
interface GigabitEthernet3/1
no switchport
ip address 10.18.192.26 255.255.255.252
And the core are doing load-balancing to reach the UA.
So, icmp packets are arriving from these 2 interfaces, the uplink gi3/1 (router port) and from the link that connects the UA switch.
so, pinging from the BC you have 2 ways to get to the UA, from UD1 and UD1-B, when it reaches UD1-B it goes to the vlan (ie. goes down to the UA and up to UD1A).
Not sure if this is helping.
If you need any other info let me know.
this is killing me.

Disabling ''igmp snooping'' in a VLAN (no interface VLAN) on Catalyst 6500

Can please some help?
On 4948 or 3560 I can disable igmp snooping in a specific VLAN:
sw4948(config)#no ip igmp snooping vlan ?
<1-1001>     Vlan number
<1006-4094> Vlan number
sw4948(config)#no ip igmp snooping vlan 10 ?
explicit-tracking           Enable IGMP explicit host tracking
immediate-leave             Enable IGMPv2 immediate leave processing
last-member-query-interval Last member query interval
mrouter                     Configure an L2 port as a multicast router port
static                      Configure an L2 port as a member of a group
<cr>
BUT, in 6509-E this command is not enabled:
sw6509(config-if)#no ip igmp snooping ?
access-group IGMP group access group
limit         IGMP limit
I have just found on my 6509 that I can disable igmp snooping in a SVI interface (Interface VLAN)
sw6509(config)#int vlan 20
sw6509(config-if)#no ip igmp snooping ?
access-group                IGMP group access group
fast-leave                  Enable IGMP fast leave processing
last-member-query-interval Configure IGMP leave query timeout
limit                       IGMP limit
minimum-version             Minimum IGMP version
mrouter                     Configure an L2 port as a multicast router port
querier                     Enable IGMP querier processing
report-suppression          Force a report suppression
ssm-safe-reporting          Enable SSM Safe Reporting
static                      Configure an L2 port as a member of a group
<cr>
My current 6509-E IOS version is:
System image file is "sup-bootdisk:s72033-advipservicesk9_wan-mz.122-33.SXH8b.bin"
Do I need to upgrade my IOS version?... or how can I disable ''igmp snooping'' per specific VLAN (no Interface VLAN)?
Any help would be apreciated !
Regards
guruiz

Hi Guruiz,
So, to disable igmp snooping in some VLANs in the 6509, do I need to disable it globally?
Would it be the only way?
That appears to be the only way. If you have an SVI for the vlan you want to run Multicast in, then simply enable PIM and not worry about IGMP snooping. I think, the reason you don't see this command under the layer-2 vlan is because most of the time the 6500 is used as layer-2/layer-3 and not just layer-2.
How could "no ip igmp snooping" applied globally impact my 6509 switch?
It will impact only the vlans that are running Multicast. In general, ip IGMP snooping is used when you have a flat vlan and no SVI. If you have multiple vlans and are running Multicast between them, then you can just enable PIM.
HTH

NX-OS 6.2 Cannot specify interface vlan as source-interface for logging

I have the following config on Catalyst:
logging source-interface Vlan1024
I want to be able to specify an interface vlan as the source-interface on NX-OS. The only option I can get is to use a loopback interface as the source-interface, but I want to specify an SVI. Is that possible with NX-OS?
NEXUS-7710(config)# logging source-interface ?
loopback Loopback interface

Hello
AppleWorks is bundled with only SOME machines, the iBook, iMac G5, eMac and macMini.
Of course, as the media used is a DVD with a huge capacity, the app is stored on the support wher the operating system SPECIFIC to the machine is also stored.
But this implies NO link with the two products.
AppleWorks 6 was carbonised in a hurry to show that the thing was do-able.
My point of view is that it was done assuming that a replacement app would be available quickly. So, stick to human guidelines was certainly not a priority.
In fact, what was thought to be a short period beame a long one because Mac OS X needed a lot of time to become a sufficiently stable basis on which Apple was able to build a successor to AppleWorks and, as we all know, the successor named iWork is far from a complete product. There is nothing like a spreadsheet or a database tool.
So, we have to continue to use our old fashioned AppleWorks (which is also, for many of us an old friend whith sympathetic wrinkles.)
Yvan KOENIG (from FRANCE lundi 30 janvier 2006 19:00:44)

Route map does not applied on interface vlan

Hi all,
could you pls tell me why i can't apply a route-map on an interface vlan,
belown my config:
SWBBO(config-if)#ip policy route-map TEST
                           ^
% Invalid input detected at '^' marker.
Cisco IOS Software, C3750E Software (C3750E-UNIVERSALK9-M), Version 15.0(2)SE1, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Fri 04-Jan-13 01:38 by prod_rel_team
ROM: Bootstrap program is C3750E boot loader
BOOTLDR: C3750E Boot Loader (C3750X-HBOOT-M) Version 12.2(53r)SE2, RELEASE SOFTWARE (fc1)
BBWMASALE01 uptime is 40 weeks, 1 day, 6 minutes
System returned to ROM by power-on
System restarted at 22:12:07 UTC Mon Feb 18 2013
System image file is "flash:/c3750e-universalk9-mz.150-2.SE1.bin"
Best regards,
James

Hi jon,
belown the result of sh sdm prefer,so need i a licence ip service to apply the route-maap on the interface vlan,or just entrer the config"sdm prefer routing" and reboot the switch?
SWBB0#sh sdm prefer
The current template is "desktop default" template.
The selected template optimizes the resources in
the switch to support this level of features for
8 routed interfaces and 1024 VLANs.
number of unicast mac addresses:                  6K
number of IPv4 IGMP groups + multicast routes:    1K
number of IPv4 unicast routes:                    8K
    number of directly-connected IPv4 hosts:        6K
    number of indirect IPv4 routes:                 2K
number of IPv6 multicast groups:                  64
number of directly-connected IPv6 addresses:      74
number of indirect IPv6 unicast routes:           32
number of IPv4 policy based routing aces:         0
number of IPv4/MAC qos aces:                      0.5K
number of IPv4/MAC security aces:                 0.875k
number of IPv6 policy based routing aces:         0
number of IPv6 qos aces:                          0
number of IPv6 security aces:                     60

Cisco 2504 controller, setting management wlan interface Vlan Identifier to anything but 0 loses management ability

I have setting the Management Interface Vlan Identifier to 0 or untagged.
If i change this to a vlan, I am unable to manage the device, is this correct?
Steve

If u make it untagged then specify the NATIVE vlan on the switchport..
If u tag the management interface, then dont configure the native vlan on the switchport..
Both the cases u will be able to access!!
Lemme know if this answered ur question!!
Regards
Surendra

[switchport port-security mac ] on [interface VLAN n?]

Hello,
did anyone tried to use the command [switchport port-security mac-address n?] on [interface VLAN n?] ? (for example in a 2950).
I don't have the material to make that test, and I am not sure if it works or not.
Many thanks!

Hi,
Switchport port-security as the name implies is to be configured on switchport. VLAN interface on the switch is a routed interface and hence, you can't apply any switchport configuration on it and that includes, port security.
HTH
Sundar

WiSM interface vlan requirement

Similar Messages

Maybe you are looking for