Working 1941W config

Question

Hi,
I am posting the working config from my 1941W and encourage others to do the same.
I have struggled to get this beast up and running for several months. I have had lots of other project work on at the same time but finally forced myself to sit at the console screen last monday and tackle the task from scratch and not give up till I was happy with the results.
I have searched the internet and found very little to help me program this router. Looking at the forums it looks like only 6 people including myself have actually bought one. Most of the forums postings are for incomplete and non working configs, so there was little point using those.Eventually i learned enough from other users in this forum to sort it out, but it was no easy task.
I'll describe my network:-
This router is replacing an 857W router which has provided a public access point in my building for contractors and staff who would like to keep their iphones and androids connected to the internet. The wireless access point provides to access to the internal networks of the site. The router is connected to an unlimited adsl-1 uncapped link. We use this link for heavy downloading of media files or anything else large that would quickly use up the allocation on out other internet connections.
All the internal VLANS use the 192.168.xxx.xxx range of addresses. There are several VLANS used for different purposes. In the router I blocked all access from the wirless connection to any 192.168 address.
Ok here is the router config:-
! Last configuration change at 01:49:55 UTC Mon Apr 18 2011
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
hostname Router
boot-start-marker
boot-end-marker
no aaa new-model
service-module wlan-ap 0 bootimage autonomous
no ipv6 cef
no ip source-route
ip cef
ip dhcp excluded-address 192.168.10.0 192.168.10.9
ip dhcp excluded-address 192.168.11.0 192.168.11.9
ip dhcp pool WLAN_BGN_USERS
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 208.67.222.222 208.67.220.220
ip dhcp pool WLAN_A_USERS
network 192.168.11.0 255.255.255.0
default-router 192.168.11.1
dns-server 208.67.222.222 208.67.220.220
ip domain name xxxxxx
ip name-server 208.67.222.222
ip name-server 208.67.220.220
multilink bundle-name authenticated
crypto pki trustpoint TP-self-signed-2057293210
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2057293210
revocation-check none
rsakeypair TP-self-signed-2057293210
crypto pki certificate chain TP-self-signed-2057293210
certificate self-signed 01
xxx
quit
license udi pid CISCO1941W-N/K9 sn FHK143277ZW
hw-module ism 0
username xxxxxx privilege 15 secret 5 xxxxxx!
bridge irb
interface Wlan-GigabitEthernet0/0
description Internal switch interface connecting to the embedded AP
switchport mode trunk
interface GigabitEthernet0/0
ip address 192.168.42.250 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
interface wlan-ap0
description Service module interface to manage the embedded AP
ip unnumbered GigabitEthernet0/0
arp timeout 0
no mop enabled
no mop sysid
interface GigabitEthernet0/1
no ip address
shutdown
duplex auto
speed auto
interface ATM0/0/0
no ip address
no atm ilmi-keepalive
interface ATM0/0/0.1 point-to-point
pvc 8/35
encapsulation aal5mux ppp dialer
dialer pool-member 1
interface Vlan1
no ip address
interface Vlan10
ip address 192.168.10.1 255.255.255.0
ip access-group Guest-ACL in
ip nat inside
ip virtual-reassembly
interface Vlan11
ip address 192.168.11.1 255.255.255.0
ip access-group Guest-ACL in
ip nat inside
ip virtual-reassembly
interface Dialer0
ip address 165.228.168.26 255.255.255.0
ip nat outside
ip virtual-reassembly
encapsulation ppp
dialer pool 1
dialer-group 1
ppp authentication chap callin
ppp chap hostname xxxxxx@xxxxxx
ppp chap password 0 xxxxxx
ppp ipcp dns request
ppp ipcp route default
no cdp enable
no ip forward-protocol nd
no ip http server
ip http authentication local
ip http secure-server
ip nat inside source list 1 interface Dialer0 overload
ip route 0.0.0.0 0.0.0.0 Dialer0
ip access-list extended Guest-ACL
deny ip any 192.168.0.0 0.0.255.255
permit ip any any
access-list 1 permit 192.168.42.0 0.0.0.255
access-list 1 permit 192.168.10.0 0.0.0.255
access-list 1 permit 192.168.11.0 0.0.0.255
access-list 1 permit 192.168.43.0 0.0.0.255
access-list 2 remark Management Interface ACL
access-list 2 permit 192.168.42.0 0.0.0.255
access-list 3 remark HTTP and HTTPS Access-class list
access-list 3 permit 192.168.42.0 0.0.0.255
access-list 3 deny any
control-plane
line con 0
line aux 0
line 67
no activation-character
no exec
transport preferred none
transport input all
transport output pad telnet rlogin lapb-ta mop udptn v120 ssh
line vty 0 4
access-class 2 in
login
transport input telnet ssh
scheduler allocate 20000 1000
end
I have applied the Guesl-ACL at the VLAN 10 and VLAN 11 sections to only allow wireless clients to access the internet.
The next section is the AP config:-
ap#show run
Building configuration...
Current configuration : 4297 bytes
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname ap
enable secret 5 xxxxxx
no aaa new-model
dot11 syslog
dot11 ssid XXXXXX_WLANA
   authentication open
   authentication key-management wpa
   guest-mode
   wpa-psk ascii 7 XXXXXX
dot11 ssid XXXXXX_WLANBGN
   authentication open
   authentication key-management wpa
   guest-mode
   wpa-psk ascii 7 XXXXXX
crypto pki trustpoint TP-self-signed-4063558620
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-4063558620
revocation-check none
rsakeypair TP-self-signed-4063558620
crypto pki certificate chain TP-self-signed-4063558620
certificate self-signed 01
  XXXXXX
  quit
username Cisco password 7 XXXXXX
username admin privilege 15 secret 5 XXXXXX!
bridge irb
interface Dot11Radio0
description 802.11bgn radio
no ip address
no ip route-cache
encryption mode ciphers aes-ccm
broadcast-key change 3600
ssid XXXXXX_WLANBGN
antenna gain 0
station-role root
no cdp enable
bridge-group 11
bridge-group 11 subscriber-loop-control
bridge-group 11 block-unknown-source
no bridge-group 11 source-learning
no bridge-group 11 unicast-flooding
bridge-group 11 spanning-disabled
interface Dot11Radio1
description 802.11a radio
no ip address
no ip route-cache
encryption mode ciphers aes-ccm
ssid XXXXX_WLANA
antenna gain 0
no dfs band block
channel dfs
station-role root
no cdp enable
bridge-group 10
bridge-group 10 subscriber-loop-control
bridge-group 10 block-unknown-source
no bridge-group 10 source-learning
no bridge-group 10 unicast-flooding
bridge-group 10 spanning-disabled
interface GigabitEthernet0
description the embedded AP GigabitEthernet 0 is an internal interface connecti
no ip address
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
interface GigabitEthernet0.10
description 802.11a bridge
encapsulation dot1Q 10
no ip route-cache
bridge-group 10
bridge-group 10 subscriber-loop-control
bridge-group 10 block-unknown-source
no bridge-group 10 source-learning
no bridge-group 10 unicast-flooding
bridge-group 10 spanning-disabled
interface GigabitEthernet0.11
description 802.11bgn bridge
encapsulation dot1Q 11
no ip route-cache
bridge-group 11
bridge-group 11 subscriber-loop-control
bridge-group 11 block-unknown-source
no bridge-group 11 source-learning
no bridge-group 11 unicast-flooding
bridge-group 11 spanning-disabled
interface BVI1
ip address dhcp client-id GigabitEthernet0
no ip route-cache
ip http server
ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag 1 route ip
line con 0
no activation-character
line vty 0 4
login local
end
bridge
Lastly to actually make the VLANS talk between the router and the access point you need to enter the VLAN info into the internal switch:-
use the command line to manually define the vlans into
interface Wlan-GigabitEthernet0/0
description Internal switch interface connecting to the embedded AP
switchport mode trunk
ie VLAN 10
          name BGN VLAN
   VLAN 11
           name A VLAN
This was a critical step that many people missed.
The next step in my project will to enable one or two more SSIDs on the Access Point and have a secure conection to the corporate LAN. This will be done with proper user authentication and possibly MAC address restrictions. I'll set up a remote access server for the users to authentcate to.
Each VLAN can have its own access list applied, so bind every SSID to its own VLAN number. Dont forget to add the new VLANS to the Wlan-GigabitEthernet0/0 interface.
All the best of luck getting you 1941W's to work, and again please posting working configs for others to use. It only takes a few minutes and could save others many hours of effort. Write a brief description as to what role the router is playing so people can choose the best example to modify.

Answer 1

The difficulty i had with this router is that there is no serial port connection to the wireless AP.
When setting it up, if I changed too many parameters i lost contact with the virtual console of the wirelss AP. I sometimes needed to do a factory reset of the router to get back control.
There is an ethernet switch inside the unit that also need to be set up to pass traffic between the two access points and the rest of the router. I have documented this near the end of my posting.
interface Wlan-GigabitEthernet0/0
description Internal switch interface connecting to the embedded AP
switchport mode trunk
ie VLAN 10
          name BGN VLAN
   VLAN 11
           name A VLAN
The config printouts are two seperate listings, one is from the router and the other from the access point.
I found that the less i mofied the wlan-ap0 interface the better it worked.Other examples I found on the internet for this router assigned wlan-ap0 vlan or IP address information, which broke the access to the wlan ap console port for me.
the 192.168.42.xxx network is on my default vlan and I did not need to define it any further for it to work. I am only using the ethernet 0/0 port at the moment.