1

I am trying to separate the traffic of a wireless controller using VLANs. I have a Cisco 4400 wireless LAN controller configured to connect to the guest VLAN on an HP ProCurve 5412zl switch. The controller has been configured to use web policy and authentication. The interface name is guest-vlan, the VLAN identifier is 10, and the IP address is 192.168.101.2. The firewall has the 192.168.101.1 IP address.

Switch configurations:

Core Switch config:
hostname "Prod-Core"
module 1 type j8702a
module 2 type j8702a
module 3 type j8702a
module 4 type j8702a
module 5 type j9309a
module 6 type j8702a
mirror 1 port A24
fault-finder broadcast-storm sensitivity high
fault-finder bad-driver sensitivity high
fault-finder bad-transceiver sensitivity high
fault-finder bad-cable sensitivity high
fault-finder too-long-cable sensitivity high
fault-finder over-bandwidth sensitivity high
fault-finder loss-of-link sensitivity high
fault-finder duplex-mismatch-hdx sensitivity high
fault-finder duplex-mismatch-fdx sensitivity high
fault-finder link-flap sensitivity high
power-over-ethernet pre-std-detect ports F1-F24
timesync sntp
sntp unicast
sntp 60
sntp server priority 1 10.100.12.33
sntp server priority 2 10.100.12.32
time daylight-time-rule continental-us-and-canada
time timezone -360
web-management idle-timeout 900
ip access-list extended "vlan68-DEVEL_ACL"
     10 remark "ACL Applied to the vlan 68 interface (in)"
     11 remark "-----------------------------------------"
     12 remark "Allow traffic to flow within the DEVEL vlan"
     13 permit ip 10.100.68.0 0.0.3.255 10.100.68.0 0.0.3.255
     22 remark "Allow 80, 443 for Exchange and KBOX"
     23 remark "-----------------------------------------"
     24 permit tcp 10.100.68.0 0.0.3.255 10.100.15.40 0.0.0.0 eq 80
     25 permit tcp 10.100.68.0 0.0.3.255 10.100.15.40 0.0.0.0 eq 443
     26 permit tcp 10.100.68.0 0.0.3.255 10.100.15.91 0.0.0.0 eq 80
     27 permit tcp 10.100.68.0 0.0.3.255 10.100.15.91 0.0.0.0 eq 443
     28 permit tcp 10.100.68.0 0.0.3.255 10.100.15.98 0.0.0.0 eq 80
     29 permit tcp 10.100.68.0 0.0.3.255 10.100.15.98 0.0.0.0 eq 443
     30 remark "Block 80, 443"
     31 remark "-----------------------------------------"
     32 deny tcp 10.100.68.0 0.0.3.255 10.100.12.0 0.0.3.255 eq 80
     33 deny tcp 10.100.68.0 0.0.3.255 10.100.12.0 0.0.3.255 eq 443
     80 remark "Allow Other Dev to Prod traffic"
     81 remark "-------------------------------"
     82 permit ip 10.100.68.0 0.0.3.255 10.100.12.0 0.0.3.255
     90 remark "Allow Everything else (Internet)"
     91 remark "--------------------------------"
     92 permit ip 10.100.68.0 0.0.3.255 0.0.0.0 255.255.255.255
     100 remark "Allow return Internet traffic"
     101 remark "--------------------------------"
     102 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255
   exit
ip authorized-managers 10.100.12.0 255.255.252.0 access manager
ip default-gateway 10.100.12.1
ip route 0.0.0.0 0.0.0.0 10.100.12.1
ip routing
..........
..........
..........
snmp-server community "public" unrestricted
snmp-server host 10.100.13.130 community "public" trap-level critical
snmp-server contact "Dave Guyton - 2463" location "HQ"
vlan 1
   name "DEFAULT_VLAN"
   no untagged D1-D3,D7,D9,D11,D14,D16,E1-E4,F1-F24
   untagged A1-A24,B1-B24,C1-C24,D4-D6,D8,D10,D12-D13,D15,D17-D24
   ip address 10.100.12.10 255.255.252.0
   ip local-proxy-arp
   forbid D14,D16
   exit
vlan 5
   name "CharterInternetHA"
   untagged D1-D3
   no ip address
   forbid A1-A24,B3-B24,C1-C24,D5-D24
   exit
vlan 6
   name "AT&TInternetHA"
   untagged D7,D9,D11
   no ip address
   forbid A1-A24,B3-B24,C1-C24,D1-D6,D8,D10,D12-D24
   exit
vlan 7
   name "iSCSI VLAN"
   untagged E1-E4,F1-F24
   no ip address
   forbid A1-A24,B1-B24,C1-C24,D1-D24
   exit
vlan 10
   name "DMZ-Guest-WLAN"
   tagged D14,D16,D20
   no ip address
   exit
vlan 68
   name "DEVEL-68"
   tagged A19,D23-D24
   ip access-group "vlan68-DEVEL_ACL" in
   ip address 10.100.68.1 255.255.252.0
   ip local-proxy-arp
   exit
vlan 72
   name "VOICE"
   tagged D23-D24
   ip address 10.100.72.1 255.255.255.0
   ip local-proxy-arp
   dhcp-server
   exit
no spanning-tree bpdu-throttle
no autorun
no dhcp config-file-update
no dhcp image-file-update
dhcp-server pool "vlan72-Voice"
   authoritative
   default-router "10.100.72.1"
   dns-server "10.100.12.33,10.100.12.32"
   domain-name "memco.local"
   lease 08:00:00
   network 10.100.72.0 255.255.255.0
   option 4 ip "10.100.12.33,10.100.12.32"
   option 42 ip "10.100.12.33,10.100.12.32"
   option 156 ascii "ftpservers=10.100.13.16, layer2tagging=1, vlanid=72"
   range 10.100.72.75 10.100.72.253
   exit
dhcp-server enable<br/>

IP Route Entries:

  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
  ------------------ --------------- ---- --------- ---------- ---------- -----
  0.0.0.0/0          10.100.12.1     1    static               1          1
  10.100.12.0/22     DEFAULT_VLAN    1    connected            1          0
  10.100.68.0/22     DEVEL-68        68   connected            1          0
  10.100.72.0/24     VOICE           72   connected            1          0
  127.0.0.0/8        reject               static               0          0
  127.0.0.1/32       lo0                  connected            1          0<br/>
15
  • What is the problem you're having?
    – Ron Trunk
    Oct 23, 2015 at 22:50
  • Users do not get the login page, an IP address from the wireless controller, and they are unable to connect to the internet. The wireless controller is setup as an Internal DHCP server and has been configured to use the default Web Login Page. Oct 26, 2015 at 13:53
  • It sounds like the problem may be on the WLC. Are your clients associating with the WLC? What is the Policy Manager State (Client detail page)?
    – Ron Trunk
    Oct 26, 2015 at 14:00
  • The status of the client is Associated, but the IP address is 0.0.0.0. Oct 26, 2015 at 14:08
  • What is the Policy Manager State (on the client detail page)?
    – Ron Trunk
    Oct 26, 2015 at 14:09

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.