My question is about addressing a Cisco router interface so that I can use both bridging through an access point as workgroup-bridge and also connect to the access point to configure it.

Apologies for such a long (first!) post: the question is short but the context is long!

Purpose: I have routers installed for telemetry but unfortunately the uplinks, normally ADSL or PPPoE/fibre, are sometimes months in coming and we need to find interim methods to connect. In one particular site, we have good wifi so I want to use that. I control the router, the AP, the PCs; I don't control the wifi supply (infap etc in diagram below.)

Question: How do I configure the AP/router so that both bridging through to the gw and direct router-AP traffic works?

Working! I have it working on the bench with available old parts.

• Cisco 837 router running 12.3(14)T7
• Cisco 1231G-E-K9 access point running 12.3(8)JEC3
• Upstream wifi and internet connection all working, not in my control

I'd like to use this AP as I have lots of them; the real routers are typically 867VAE-K9 running C860VAE-ADVSECURITYK9-M Version 15.5(3)M.

Diagram

       \|/ - - - - - - - - - - - - \|/           INTERNET 
        |                           |             |
        ap                         infap   dhcpd  gw
    bvi1|.2      10.0.0.0/24        |        |    |  
   =+===+==========                =+========+====+====
  e2|dhcp
   router+NAT
  e0|.1          192.168.13.0/24
====+====+====+====
         |.32 |.33
         pc   pc  ...

Behaviour

The AP correctly associates; the router can get DHCP through int e2 and default route to gw so the goal is achieved. But then router can't ssh to the AP to configuration it. If int e2 is set to static 10.0.0.1, ssh to AP on 10.0.0.2 works fine, but obviously internet connection doesn't.

With int e2 as DHCP we get a correct lease with correct default route to gw but we don't know what address that will be.

So I tried having both ip address dhcp and ip address 10.0.0.1 255.255.255.0 secondary, but it's not permitted.

On the bench I just change to ip address 10.0.0.1... to adjust the AP, but can't do that when live because it would be a Daffy-Duck-Saws-Branch-He's-Sitting-On moment.

There's a trick I'm missing somewhere surely!

All suggestions gratefully received,

Jonathan.

Router:

This is Cisco 837 ADSL router, has a 4-port 10/100 switch, with FE1,2,3 connected to ethernet0 and FE4 connected to ethernet2.

interface Ethernet0
 ip address 192.168.13.1 255.255.255.0
 ip nat inside
!
interface Ethernet2
 ip address dhcp
 ip nat outside
!
ip nat inside source list NATLIST interface Ethernet2 overload
!
ip access-list standard NATLIST
 permit 192.168.13.0 0.0.0.255

Access point:

bridge irb
interface Dot11Radio0
 no ip address
 no ip route-cache
 ! encryption mode speed ssid omitted: associates fine
 station-role workgroup-bridge
 bridge-group 1
 bridge-group 1 spanning-disabled
!
interface FastEthernet0
 no ip address
 no ip route-cache
 bridge-group 1
 bridge-group 1 spanning-disabled
!
interface BVI1
 ip address 10.0.0.2 255.255.255.0
 no ip route-cache
!
bridge 1 route ip