802.1Q VLAN over Deliberant APC wireless bridge - am I doing something wrong?

Question

I've previously run a Cisco based network (Catalyst switches, ASA and PIX firewalls) which segmented a medium sized business network into 8 VLANs with little issue. I've recently started in a new company and have taken over part of the network admin, which includes creating a VLAN configuration to allow for a staff "guest" network and to provide for segmentation to test customer equipment, this time using a mix of D-Link switches, D-Link and Zyxel wireless access points, a Draytek Vigor 2830 router, and a pair of Deliberant APC 5M-18 V2 units in a wireless bridge configuration connecting two buildings.

Setting up a VLAN network in the main office was fairly straightforward, tagging the ports on the primary D-Link switch (a DGS-1210-48) that connected to the Zyxel access point, and adding a second SSID to the access point and adding VLAN IDs to both SSIDs. Initially the Vigor 2830 caused problems due to it giving out the wrong IP address and DNS settings from time to time, apparently it's a common issue with using multiple VLANs on a single port so the Vigor was given two connections to the main switch, both ports on the switch untagged but with the appropriate PVID for the LAN configured on the matching router port. This works as expected, and has been up and running for a few weeks without any problems.

Here is a very simplified (I've left out all the printers, servers, desktops, etc., to focus just on the main elements that are affected by the VLAN changes) diagram of the VLAN configuration so far:

Switch 192.168.4.4 is the main switch, a D-Link DGS-1210-48. The Deliberant wireless bridge units are labelled "APC U12" (running in Access Point mode) and "APC U14" (running in Station mode) configured as a Point-to-Point bridge. Switch 192.168.4.12 is the switch in the other office, a D-Link DES-1210-28.

Where I'm having trouble is extending the VLAN over the wireless bridge. We have two buildings, separated by a car park, and are currently using a pair of Deliberant APC 5M-18 V2 units - these are 5Ghz IP66 rated units for external fitting that can provide connectivity up to around 20km in PTP mode, however we are using them to bridge about 100m. They work well as a bridge, and with no VLANs have been running here at the company for about a year. However, they have become a sticking point with extending the VLANs to our other building.

The Deliberant APC units themselves have no VLAN settings. I have been in touch with Deliberant support and they are adamant that there is nothing to configure on the units, and that they will pass frames across the bridge whether they have 802.1Q VLAN header data or not, and they have an MTU of 3790 bytes so should be plenty large enough to accommodate the 802.1Q bytes. Apparently all we have to do is add the 802.1Q header and that's it. But this is where we're finding a disparity between what they're telling us and what we actually see.

As soon as the switch port 42, connected to APC U12, on the D-Link DGS-1210-48 is "tagged" so that frames have the appropriate VLAN header added, no PC in the main office can ping or connect to the APC U12 unit. Same happens when port 13 on the switch on the other end is "tagged", APC U14 cannot be pinged or accessed. No traffic appears to pass over the bridge when either/both port is tagged, but also nothing is shown the APC logs (which can be accessed once the ports are untagged). No errors are displayed in the switch logs either.

Even if I only tag the switch ports as a member of VLAN1 (leaving them as not a member of VLAN2) devices on one side cannot contact the other side, and I've tried rebooting the switches and wireless bridge units with no luck. As soon as they D-Link ports are returned to their "untagged" setting and a PVID of 1 the bridge starts passing traffic again. Working from the main office side, I can tag port 13 on the switch on the far side and still ping it/use the web admin interface, so I assume that the frames have on VLAN headers at this point as the remote switch is simply replying to ping packets that have no VLAN header. It is only when the local switch has it's port 42 tagged that I can no longer connect to the APC units or the remote office switch/devices. As soon as port 42 is untagged everything works again.

Deliberant support have had copies of the configs from both APC units, and claim that they have replicated our network in their lab and it works "perfectly" when tagging the switch ports. Obviously as they don't have D-Link switches, or our switch config backups, they cannot possibly have duplicated our network setup. They have offered to remote in to our network and take a look, but so far we have arranged this on 4 different days and on each occasion their assigned engineer has failed to connect in.

So to my questions,

Am I correctly configuring the switches at each end of the wireless bridge, by setting the ports connected to the APC units to "tagged" for VLAN1 and VLAN2?

Is my assumption that the Deliberant APC units are dropping the frames with VLAN headers a reasonable one?

Has anyone had success with using a pair of Deliberant APC 5M units in PTP bridge mode and having multiple VLANs pass over the bridge?

Regards,

Dan

Answer 1

Please ignore the comment above, it was supposed to be an answer but I can't delete it.

I have this evening spent some time in a remote session with Deliberant support, and between us we managed to nail down the issues so it now works. I'm posting this information in case it is of help to anyone else in the future.

1) The Deliberant APC web interface will not respond to tagged frames. This requires the switch ports connected to the APC units to have at least one untagged VLAN assigned, and this VLAN to be used for management of the units. By setting the ports at each end to tagged in VLAN2, untagged in VLAN1, and a PVID of 1 the APCs can be managed from VLAN1 while still allowing VLAN2 traffic.

2) Always check your physical switch ports! After trying to get VLAN2 to work over the bridge unsuccessfully the company electrician handily pointed out that he'd moved some cables, but didn't tell the IT department that he'd unplugged anything. He thought he'd put the cables back in the same place, but when we checked during the support call found that the cables were put in the wrong ports.

The support call wasn't a complete waste of time in that it identified (1) as an issue, but had the IT documentation been updated to reflect the remote switch cable configuration having been changed the VLANs would have been working prior to the support call. As it is we would still have had the issue of not being able to manage the Deliberant APC units given that they drop tagged frames directed to their management interface.

Dan