1

We've got a problem with our WiFi company network. We bought a Cisco Switch and Wireless LAN Controller (Cisco 2500 WLC) plus eight Access Point (Aironet 2700) to offer clients seamless roaming between APs. These APs work like charm (I think it's just because they are from the same vendor), but our network was at first stages built around Mikrotik devices and now we are heading several problems.

Short about our topology: We want two WiFi networks (two SSIDs) so we made two VLANs (20,30). The traffic from Access Points is packed inside one agregated management VLAN (10). Because of agregated link the WLAN Controller is connected to network using one LAN connection. At this point everything works and everything blinks :) (and inside this Cisco "subnetwork" I am able to ping these Cisco devices each other).

enter image description here

Switch:

version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service sequence-numbers
!
hostname sw-01
!
boot-start-marker
boot-end-marker
!
!
aaa new-model
!
!
aaa authentication login default group radius local
aaa authorization console
aaa authorization exec default group radius local
aaa accounting exec default start-stop group radius
aaa accounting connection default start-stop group radius
aaa accounting system default start-stop group radius
!
!
aaa session-id common
switch 1 provision ws-c2960s-48ts-l
!
ip dhcp pool 172.18.106.0
 description Pool for first WiFi network
 network 172.18.106.0 255.255.254.0
 default-router 172.18.106.19
 dns-server 8.8.8.8
!
ip dhcp pool 172.18.113.0
 description Pool for second WiFi network
 network 172.18.113.0 255.255.255.0
 default-router 172.18.113.19
 dns-server 8.8.8.8
!
spanning-tree mode pvst
spanning-tree extend system-id
no spanning-tree vlan 1-4094
!
!
vlan internal allocation policy ascending
!
interface GigabitEthernet1/0/1
 description Connection WLAN Controller switch
 switchport mode trunk
!
interface GigabitEthernet1/0/4
 description AP connection to WLAN Controller 
 switchport access vlan 10
 switchport mode access
 switchport voice vlan 10
 spanning-tree portfast
!
interface GigabitEthernet1/0/13
 description Connection WLAN Controller and Mikrotik 
 switchport mode trunk
!
interface Vlan20
 ip address 172.18.106.10 255.255.254.0
!
interface Vlan30
 ip address 172.18.113.10 255.255.255.0
!
ip default-gateway 172.18.105.19
ip http server
ip http secure-server
!
logging history informational
logging facility local6
logging host XX.XX.XX.XX
!
snmp-server community public RO
!
ntp logging
ntp server xx.xx.xx.xx
end

BUT:

  1. first problem is the DHCP server. When it is configured on Cisco switch all WiFi clients get their IP with no problems. But when it is configured on Mikrotik the WiFi client gets the IP but when looking into Mikrotik ARP tables they have the same MAC address. The MAC address of WLAN Controller.
  2. when I try to ping Mikrotik router from Cisco switch it works. When I try to ping Cisco switch from Mikrotik it also works. But when I try to ping Mikrotik from WiFi client the client sends ARP request but is unable to get any reply from Mikrotik at all (all clients have IP address and default gateway set properly). And when I try to ping client from Mikrotik router it also doesn't work but after 2 or 3 minutes it starts work!

This is madness and we had to misconfigure something or some sort of service/protocol does not works properly between Mikrotik and Cisco. Have you ever seen something like this.

Thank you for your help!

PARTIAL SOLUTION:

Well, we found that we had several problems under one roof. And we overcame it by using brute force techniques (very time-consuming...)

  1. all AP should be connected through Trunk BUT with a native VLAN configured. In our case it is trunk with native VLAN 10.
  2. we changed ARP cache timeout on Cisco Switch to 20 sec.
  3. we made DHCP server on Mikrotik BUT we also had to configure Cisco Switch as DHCP Relay Agent.
  4. the most important thing is that we change AP mode to flexconnect technology, so all APs are autonomous but we lost advanced roaming feature provided by Wireless LAN Controller. Now, all WiFi clients manage their connection, itself. This is very buggy because of bad implementation of roaming in today's WiFi chips.
  5. we flashed the WLC to newest version...
  6. we turned off VTP prunning on Cisco switch. Maybe this was the main cause of that undefined behavior of ping.

So simple...

  • You should edit your answer to include the device configurations. – Ron Maupin Jul 29 '16 at 8:21
  • I added the switch config I wanted add WLC config but there are thousands lines in sh run-config. And Mikrotik is our backbone router with a lot of configuration too... – user2201196 Jul 29 '16 at 9:50
  • It's really the switch and primarily the router which we need to see. – Ron Maupin Jul 29 '16 at 14:12
  • Which device has these two addresses: 172.18.106.19 and 172.18.113.19? Why does the switch have a different gateway, 172.18.105.19, but there is no VLAN with that network? – Ron Maupin Jul 29 '16 at 14:14
  • Address 172.18.106.19/172.18.113.19 is a default router address on that VLAN. It's there because WiFi client is gaining IP address right from the DHCP server running on switch and client needs it so to be able to get to the Internet. And that default router is in all cases the Mikrotik router. – user2201196 Jul 30 '16 at 20:27
1

I would run your APs in local mode and make sure you are trunking to the controller. Then put the ports that your APs are plugged into as access ports for vlan 10. This should get your roaming working.

In your controller, configure two interfaces with vlan ids for 20 and 30 (Controller > Interfaces). Then on your SSIDs assign the interfaces that your just created. (WLAN > [wlan_name] > Interface/Interface Group(G)).

When APs are in local mode, they tunnel all client traffic back to the controller to make a routing decision. This way you don't need to trunk to each AP and the roaming will be controlled by the controller.

I seen in your partial solution that you have to configure DHCP relay on the 2960S switch. I thought this was strange because the switch is a layer 2 device and DHCP broadcasts should work without it. That is unless the trunk isn't correct to the Mikrotik.

I have this setup in a few places where wireless is critical and it works very well.

Josh

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.