Cisco Wireless :: Wlc2112-k9 802.1x Dynamic Vlans On Multiple Ports
Mar 16, 2013
I have a wlc2112-k9. I have succesfully setup a WLAN with 802.1x authentication and dynamic VLAN assignment. The issue I have (and maybe it isn't an issue and just the way the controller works) is that if the vlan interfaces I have defined are connected to different ports from which the default interface for the WLAN it doesn't work.So for instance, I create my WLAN and set the interface to the management interface (which is connected to port 1). I then define all my other vlan interfaces that could be returned by my radius server.[code]
Port 1 is configured on the switch on vlan 21. If the radius server returns a VLAN ID of 102, 104 or 106 my client successfully connects to the WLAN but it gets put on VLAN 21. However if I move the vlan interfaces above over to port 1 the client correctly gets put on the correct VLAN.All ports on the switch are configured as trunk with the native vlan set to the corresponding value that is set on the WLC.
Is this just the way the controller functions? That it can't assign a client to a different interface that is connected to a different port from the default one setup when the WLAN is created? I would have just though that if the radius server returned VLAN 102 that it would find that interface and connect the user session via that interface regardless of the port it is configured on.
how i can configure a second ssid for guest access in our environment. this is our network setup prior to this request: Internet----Firewall (not ASA)---ce520---C1131AG and CME router is also connecting to the ce520 switch. we only have two vlans: one for voice and two for data.
Presently, there is no vlan configured on the AP because it on broadcasting ont ssid and wireless users gets IP from a windows DHCP server on the LAN. the configuration on the ce520 switch port for the AP and other switches say access vlan is the DATA vlan which automatically becomes the native vlan for all trunk port connecting the AP and other Stiches to the network.
Now with this new requirement, i have made my research and i have configured the AP to broadcast both the production and the guest Vlans. The two vlans are 20-DATA and 60-Guest. I made the DATA vlan on the AP the native vlan since the poe switch is using the DATA vlan as native on the trunk ports. I configured the firewall to serve as DHCP server for the guest ssid and i have added the ip helper-address on the guest vlan interface on all switches while the windows server remains the dhcp server for the production DATA Vlan. I have confirmed that the AP, switches can ping the default gateway of the guest dhcp server which is another interface on the firewall. I can now see and connect to all broadcasted ssids but the problem is I am not getting IP addresses from both the production dhcp server and guest dhcp server when i connected to the ssid one at a time. My AP config is attached below.
Do i need to redesign the whole network to have a native vlan other nthan the data vlan? Does the access point need to be aware of the voice vlan? Do the native Vlan on the AP need to be in Bridge-group 1 or can i leave it in bridge-group 20?
My question is if I can configure 3 ssid, for 3 different VLAN and add the DHCP address from a WAP4410N AP, when you upgrade to the latest version of IOS I can have this functionality?
i have a problem with our new 5508 wireless controller (7.0.116.0).
Port 1 is the system default "management" (Port 2 is backup). Dynamic AP Management is disabled. Port 3 is a new dynamic interface "ap-manager 2" with Dynamic AP Management enabled and has a ip in a seperated VLAN which is not routed.
When i am connecting the AP (1260 series) to the "ap-manager 2" interface, then it will not join and i get an error message on the WLC:
*spamApTask1: Mar 05 14:52:12.783: %CAPWAP- -DISC_INTF_ERR1:capwap_ac_sm.c:1453 Ignoring discovery request received on non-managementinterface (3) from AP
When i am connecting the AP to the "management2 interface, then it is working fine. But i don't want the APs in the Management LAN. I want them in the separated no routed LAN explicit for the APs.
I have two Cisco 1300's acting as bridges only. I have created an infrastructure ssid on VLAN 2 and assigned this to the radio. I am carrying multiple VLANs between the bridges (using subinterfaces on the fastethernet and radio ports).I have enabled WPA-PSK, but how do I check that this is being used between the bridges? Also - I have a switch connected at each end of the bridge. When I make VTP changes, the remote switch does not pick these up - is this because VTP goes over VLAN1 regardless of the Native VLAN (2 in my case)? Do I have to carry VLAN1 over the bridge to get VTP working, or is there an alternative solution?
We have a pair of 1310's (running 12.3(8)JEA3) connecting 2 buildings together. The wired side of each AP is connected to switchports configured as access ports.
But, now we need to extend multiple VLANs across the wireless bridge. So I'm thinking I just need to configure some sub-interfaces on the radio side and ethernet side and bridge them together. But I'm unclear on if I need an SSID for each bridge group. I would hope not. But after reading this, I'm not sure. Most of the documentation seems to be dealing with wireless clients. Well, in this case I don't have any wireless clients and just need to extend VLANs.
These 2 sites are hundreds of miles away from where I am, and I don't have any 1310's to test this out on. Should I be able to load similar software on other AP's (like 1142's) and have them function as bridges to test this out?
I have two 1142n LWP ap converted into standalone, as client doesn't have any controller there. They just want to extend their network via wireless.
L3 switch (trunk port gig 1/48) -----> connected to AP1 L3 switch (trunk port 2/48) -----------> connected to AP2
client is looking for 3 vlans on the floor ( users might multiple vlans might associated same AP ). They have a dedicated DHCP/DNS server and he will be configuring 3 vlans on L3 switch with correct ip helper address on SVI interfaces.
I'm i allowed to created 3 SSID's on 1142n standalone AP ?
What would the various optiosn to achieve this requirement ? Is there any simplest way to achieve this ? Do i need to go for 802.1x ? I remember client told their users are authenticating by using AD for wired network. This is their first request for wireless environment
I read from this forum some discussion about the WLC VLAN Select feature. [URL]. I see that you can use this feature to have multiple VLANS (interfaces) to map to the same WLAN (SSID).
What I try to learn is under what scenarios would people need to have mutliple vlan mapped to single SSID?
In my environment, I have 50+ AP int he campus on 20+ Cisco 4500 switches. I have single WLAN and it is mapped to one subnet. All wireless users would be on that subnets, whereas wired users are on 20+ subnets of their own.
I'm trying to figure out if it is possible to configure in one site a wireless setup that goes like this:
One WLC (5508), multiple LAP's in H-REAP mode.
AP's will be splitted in multiple VLAN's belonging to different departments but with the same SSID.Each VLAN will have it's own DHCP scope. All AP's are located in the same site and I need to know if it is possible to roam between AP's that belong to different departments?
I'm in the process of trying to get a used LAP1142N access point connected to my already established WLAN. We currently have 7 active LAP1142N, our controller is a AIR-WLC2112-K9, and I am only trying to add one additional access point. I say this access point is used because we purchased it used, given it's not out of the box and hasn't ever been active in my environment. So far what I've tried is initially connecting the access point on to my network (powered over Ethernet) and consoled in from my desktop. With this, I was able to see the previous configuration so I ran a write erase/ reload. The AP shows a solid green light, but doesn't receive any configuration from the controller even when plugged directly in to the controller (on ports 7 and 8). I'm new to wireless, but familiar with Cisco CLI and web interfaces. I can't necessarily tell if this AP is set to autonomous as opposed to lightweight, but that could be the problem. Otherwise I'm lost. I've attached text files with the boot from CLI and show run from CLI.Let me know any additional information you may need. End note, I'm recieving DHCP (you can tell from boot), but it's not the same subnet as my controller or other active access points.
I am implementing wireless lan controller for a customer's site. This site uses Cisco WLC2112 and AIR-LAP1041. I configure via start-up wizard and WLAN security configuration. The client joining via WLAN seems to work fine, able to browse Internet. But when adding a shared printer or sharing files, the machine's unable to find the computer name. When test pinging, it replies when pinging by IP only. This is not happened when using a LAN wire.
How to configure DHCP server if i have 2 vlans. I know how to configure rest of the network, just i don't know server.I use packet tracer and i attached file with my network. PC1 is on VLAN1 and PC2 is on VLAN2.I want ip addresses in vlan1 to be from 192.168.1.2 and in vlan2 from 192.168.2.2. I would like to do it just like in the designed network, without router.
The network topology is like this. Router with DHCP_Server on it.
VLAN 10 VLAN 20 VLAN 30
My question is how to configure the router so that all devices on all 3 VLANS can obtain IP from the router. I've tried to enable proxy arp on all interfaces and create sub interfaces and trunk them to their appropriate vlans, but I can't specify the gateway on all trunked sub interfaces because I get a warning that addresses overlap. Then I tried to set access-group on all sub-interfaces and still doesn't work.
I have 2 SG300-10 switches, and I need two VLANs, one for internal network and one for WiFi APs.I need ports 1->4 on both switches to be part of 1st VLAN and ports 5->8 on 2nd VLAN; and port 10 uplink to 2nd switch.How I set up the VLANs and interface VLAN mode?
I'm trying to setup a VPN connection for the two PC's in the graphic below. I have the link between the two locations setup and secured, now I just working with the routing elements.what I need to add to the firewall config in order to get this to work? Here is what I have:
SITE A------access-list mpls_vpn_sitea extended permit ip host 172.168.199.1 host 172.168.199.2 access-list mpls_vpn_sitea extended permit ip TEST-LOCAL 255.255.255.0 TEST-REMOTE 255.255.255.0crypto map mpls_vpn 1 match address mpls_vpn_siteacrypto map mpls_vpn 1 set peer 172.168.199.2 crypto map mpls_vpn 1 set transform-set ESP-3DES-SHAcrypto map mpls_vpn interface MPLScrypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac SITE B------access-list mpls_vpn_siteb extended permit ip host 172.168.199.2 host 172.168.199.1 access-list mpls_vpn_siteb extended permit ip TEST-LOCAL 255.255.255.0 TEST-REMOTE 255.255.255.0crypto map mpls_vpn 1 match address mpls_vpn_sitebcrypto map mpls_vpn 1 set peer 172.168.199.1 crypto map mpls_vpn 1 set transform-set ESP-3DES-SHAcrypto map mpls_vpn interface MPLScrypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
do I need to specify a route between the two networks? What do I need to have for NAT statements?
I recently set up a Cisco 881 to cover a small business network. The router is currently set up and working as expected. We recently decided to move to VoIP phones and here is where I'm running into some issues.
First an overview: We run a network with a cable internet WAN connection, this connection is DHCP, however we have a static IP through our ISP. We also have a block of 30 additional IP addresses for one to one mapping as we need them. The new VoIP system is being run over T1 lines throughout the township (we are a municipal organization) and the VoIP system is being run to about 5 buildings in the township.
This brings me to the topic of VLANs. As the phone engineer explained it to me, there is a network set up over the T1 that allows the VoIP equipment to talk to one another and operates all of the VoIP phones on one network. The equipment that is being installed at our building connects to the network over the T1 and "talks" to the other equipment on the network. The engineer wants to create a VLAN and run it on ports fa1 and fa2, with the fa2 port being connected to the actual "MPLS" (their term) that connects to the T1 and into the cloud, and the fa1 port connected to the internal phone switch.
TLDR; The problem is this: When we attempt to set up the VLAN on ports fa1 and fa2, we have no connectivity with the other units in the external VoIP cloud. Pinging while directly connected to the "MPLS" yields successful pings, while pinging from the router with the "MPLS" connected to fa2 yields failures. I'm going to post the running config below, I feel like what we're doing should be working. I asked around about subinterfacing, but others seemed to think this was not necessary.
ROUTER CONFIG Building configuration...
Current configuration : 4909 bytes ! ! No configuration change since last restart version 15.1
I am having problems accomplishing these tasks with my new SG 200-18.
I have a LinkSys WRT54G2 connected to port 1. I would like ports 2-8 to be in one VLAN with access to the Internet and to be able to share their printers, hard drives, etc. with other computers on ports 2-8. I would like each of ports 9-16 to be on a separate VLAN with access only to the Internet and no other ports on the switch. I would like to be able to manage the switch from any of the ports 2-8.
After I create the VLAN 1009 (see screenshot below), port 9 can browse the Internet and cannot see the other ports on the switch which is correct. However, ports 2-8 can no longer access the switch at 192.168.1.20 in order to manage the switch.
I am working with MS Windows 2008 R2 and a Belkin F5D8635-4v1 router.
I have already set up a dynamic IP address which points to my router at home. In my home network I have multiple PC's that I would like to access from the internet. I would like to achieve this without needing to change my port forwarding rules on my router each time...
My thoughts are that I use a single dynamic IP address pointed to my router. My router then forwards to a server with some sort of software that can then forward to the correct PC based on the host name.
So I have 3 domains set up all pointing to the router's IP address:
The router is not smart enough to redirect by host name, so it will just forward everything to 10.0.0.20 The server based at 10.0.0.20 must then have software to now redetermine the target based on the host name. The rules would be set up as follows:
I have a RV180W and a EnGenius EAP350 Access Point. The EnGenius supports multiple SSID's and VLAN tags them. If port 1 on the RV180W has VLAN 1 untagged and VLAN2 tagged, any connection to the EnGenius always gets an IP from the VLAN 1, even though they are connected to the SSID which is tagged with VLAN2.
I have to configure multiple vlans served with a unique DCHP server . As first step, I just will The DHCP server to serve 2 vlans. The following is the hardware and configuration that I implemented :
[code]...
But If I connect the DHCP server on a trunked switch port and adapt the DHCP server gateway 172.16.0.1 to 172.16.0.254, hosts receive ip address properly.I have to connect the DHCP server directly to the router. How can I do that, what is wrong in the configuration?
the incoming fiber on ports 9 and 10 are on different subnets. I need to map the subnet on port 9 to ethernet ports 1-9 and port 10 is on its own. I have the device IPv4 address set to a static address on the same subnet as port 9. I don't know if there's an easier approach, but I attempted to map the ports using vlans (See the attached screenshots). We don't yet have the fiber link established for port 10, so I haven't had a chance to test, but I wanted to confirm that my configuration is sound. I used the default vlan for ports 1-9, because I need to manage through that subnet. I added vlan 10 for port 10, but I don't know if I have it configured correctly.
I have a test switch (Cisco 3550) that I want to set up with 6 Vlans and 2 trunk ports. I want to be able to access a virtual server conected to the trunk ports from the switch ports. Ports Fa0/1 to 8 are in a vlan port fa0/9 to 16 another vlan etc. Ports Fa0/47 and 48 are the trunk ports. This is a lab environment so the the switch is the only device being used.
Switch: SG500 VLANS: 1 (default) xxx.xxx.0.0/24 network, 150 (device management vlan) xxx.xxx.150.0/24 network I am plugged into port 1. This is a trunk port with VLANs assigned as follows: VLAN 1 (Default) - UntaggedVLAN 150 (dev mgmt) - Tagged Device is plugged into port 2. This is an access port with the following VLAN assigned: VLAN 150 - Untagged Why is it I cannot communicate with the device on port 2?
I have a above said switch at my remote office (600KM) which is connected with L2 Point to Point leased line. Both the ends I have Cisco 3950 catalyst switches with Vlans configured at both the ends. Now, for obvious reasons I should remove the other end 3950 switch and replace with Cisco 2950 switch. The other end 3950 is having 4 Vlans configured on 4 ports. Now my requirement is, I should configure 3 Vlans (one for P2P, one for 10 Desktops and one for to bring traffic from other network).
The ASA device is going to be the gateway for multiple distinct inside IP subnets. We can have have a unique outside IP address to correspond to each inside IP subnet if needed, but we need some means for a VPN client or a site-to-site VPN to have acess to a pre-definied IP subnet (i.e. if customer A establishes a VPN connection, they have connectivity to IP subnet X; customer B establishes a VPN connection, they have connectivity to IP subnet Y, etc.).Currently, the two inside IP subnets are 10.10.0.0/16 and 10.20.0.0/16. We will be adding more.The problem we are facing is that we cannot reach the VLAN 201 from the ASA we believe this is because. I have setup two addresses on port 0/1 Vlan1, 10.10.20.2 and 10.20.20.1 as an alias. How can we make traffic for the 10.10.0.0/16 subnet untagged and traffic for the 10.20.0.0/16 subnet tagged for VLAN 201.
I can't figure out how to configure a port membership with multiple VLANs. My setup:
- VLAN10 - VLAN20 - port settings tab: port24 in general mode - ports to VLANs tab: untagged everywhere, when I set port 24 membership to VLAN10 I can't set port 24 membership in VLAN20 because when I do that port 24 membership in VLAN10 dissapears and vice versa - but I can set port 24 membership to both VLANs in VLANs to port tab, but I think it doesn't work because: - when I connect hosts to ports 23 (port 23 is a member of VLAN10 only) and 24 (member of VLAN10 and VLAN20) there are not any connectivity between them - but connectivity is working when I set the same PVID for both ports 23 and 24 in port setting tab, I can't set multiple PVID in here.
So, is it possible to configure port membership for multiple VLANs on this linksys. [URL]
I have the following configurations in cisco CISCO7606 (R7000). Its meaningful to have the below configuration, wherein , we are allowing multiple vlans on the access port?
I have 8 apartments that have a single internet connection coming into the building, I then have a PoE Access Point in each of the 8x apartments.
What I would like to be able to do is to have each apartment within its own vlan, but to be able to use the internet via one of the non-PoE ports (port 9 say) but do not want residents in different flats to be able to see each others devices on the same network.
I have a Cisco SG 300-10MP which has 8x PoE ports and 2x Ethernet ports, one of which my Internet connection is plugged into (using WiMax).
We have a Cisco 887 router and a Cisco SG-200 switch.We'd like to setup trunking between these 2 devices for multiple VLANs on the switch to be made available on the router.
With previous routers, you could set the router up in the configuration 'router-on-a-stick' and VLANs worked like a charm but the 887 no longer support sub-interfaces.So how can you get trunking working between the 2 devices?
Is there a VTP configuration menu for the SG-200 which we can setup in order for it to talk 'VTP' with the 887 router??
