I am trying to separate the traffic of a wireless controller using VLANs. I have a Cisco 4400 wireless LAN controller configured to connect to the guest VLAN on an HP ProCurve 5412zl switch. The controller has been configured to use web policy and authentication. The interface name is guest-vlan, the VLAN identifier is 10, and the IP address is The firewall has the IP address.

Switch configurations:

Core Switch config:
hostname "Prod-Core"
module 1 type j8702a
module 2 type j8702a
module 3 type j8702a
module 4 type j8702a
module 5 type j9309a
module 6 type j8702a
mirror 1 port A24
fault-finder broadcast-storm sensitivity high
fault-finder bad-driver sensitivity high
fault-finder bad-transceiver sensitivity high
fault-finder bad-cable sensitivity high
fault-finder too-long-cable sensitivity high
fault-finder over-bandwidth sensitivity high
fault-finder loss-of-link sensitivity high
fault-finder duplex-mismatch-hdx sensitivity high
fault-finder duplex-mismatch-fdx sensitivity high
fault-finder link-flap sensitivity high
power-over-ethernet pre-std-detect ports F1-F24
timesync sntp
sntp unicast
sntp 60
sntp server priority 1
sntp server priority 2
time daylight-time-rule continental-us-and-canada
time timezone -360
web-management idle-timeout 900
ip access-list extended "vlan68-DEVEL_ACL"
     10 remark "ACL Applied to the vlan 68 interface (in)"
     11 remark "-----------------------------------------"
     12 remark "Allow traffic to flow within the DEVEL vlan"
     13 permit ip
     22 remark "Allow 80, 443 for Exchange and KBOX"
     23 remark "-----------------------------------------"
     24 permit tcp eq 80
     25 permit tcp eq 443
     26 permit tcp eq 80
     27 permit tcp eq 443
     28 permit tcp eq 80
     29 permit tcp eq 443
     30 remark "Block 80, 443"
     31 remark "-----------------------------------------"
     32 deny tcp eq 80
     33 deny tcp eq 443
     80 remark "Allow Other Dev to Prod traffic"
     81 remark "-------------------------------"
     82 permit ip
     90 remark "Allow Everything else (Internet)"
     91 remark "--------------------------------"
     92 permit ip
     100 remark "Allow return Internet traffic"
     101 remark "--------------------------------"
     102 permit ip
ip authorized-managers access manager
ip default-gateway
ip route
ip routing
snmp-server community "public" unrestricted
snmp-server host community "public" trap-level critical
snmp-server contact "Dave Guyton - 2463" location "HQ"
vlan 1
   name "DEFAULT_VLAN"
   no untagged D1-D3,D7,D9,D11,D14,D16,E1-E4,F1-F24
   untagged A1-A24,B1-B24,C1-C24,D4-D6,D8,D10,D12-D13,D15,D17-D24
   ip address
   ip local-proxy-arp
   forbid D14,D16
vlan 5
   name "CharterInternetHA"
   untagged D1-D3
   no ip address
   forbid A1-A24,B3-B24,C1-C24,D5-D24
vlan 6
   name "AT&TInternetHA"
   untagged D7,D9,D11
   no ip address
   forbid A1-A24,B3-B24,C1-C24,D1-D6,D8,D10,D12-D24
vlan 7
   name "iSCSI VLAN"
   untagged E1-E4,F1-F24
   no ip address
   forbid A1-A24,B1-B24,C1-C24,D1-D24
vlan 10
   name "DMZ-Guest-WLAN"
   tagged D14,D16,D20
   no ip address
vlan 68
   name "DEVEL-68"
   tagged A19,D23-D24
   ip access-group "vlan68-DEVEL_ACL" in
   ip address
   ip local-proxy-arp
vlan 72
   name "VOICE"
   tagged D23-D24
   ip address
   ip local-proxy-arp
no spanning-tree bpdu-throttle
no autorun
no dhcp config-file-update
no dhcp image-file-update
dhcp-server pool "vlan72-Voice"
   default-router ""
   dns-server ","
   domain-name "memco.local"
   lease 08:00:00
   option 4 ip ","
   option 42 ip ","
   option 156 ascii "ftpservers=, layer2tagging=1, vlanid=72"
dhcp-server enable<br/>

IP Route Entries:

  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.
  ------------------ --------------- ---- --------- ---------- ---------- -----     1    static               1          1     DEFAULT_VLAN    1    connected            1          0     DEVEL-68        68   connected            1          0     VOICE           72   connected            1          0        reject               static               0          0       lo0                  connected            1          0<br/>
  • What is the problem you're having?
    – Ron Trunk
    Oct 23, 2015 at 22:50
  • Users do not get the login page, an IP address from the wireless controller, and they are unable to connect to the internet. The wireless controller is setup as an Internal DHCP server and has been configured to use the default Web Login Page. Oct 26, 2015 at 13:53
  • It sounds like the problem may be on the WLC. Are your clients associating with the WLC? What is the Policy Manager State (Client detail page)?
    – Ron Trunk
    Oct 26, 2015 at 14:00
  • The status of the client is Associated, but the IP address is Oct 26, 2015 at 14:08
  • What is the Policy Manager State (on the client detail page)?
    – Ron Trunk
    Oct 26, 2015 at 14:09


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.