1

We've recently applied a new modification to our network config. Separating two SSIDs into a guest \ corporate split config.

All of the VLAN and DHCP scopes are functioning in the way it was designed but we're having problems with wireless performance and latency. *The wired network is unaffected.

Specifically, Wireshark is showing a pile of the following entries:

--TCP Dup ACK
--TCP ACKed unseen segment
--TCP Previous segment not captured
--TCP Retransmission

Pings from wireless devices run in a repeatable procession to LAN and WAN addresses alike:

Reply from *.*.*.* time=3ms
Reply from *.*.*.* time=2ms
Reply from *.*.*.* time=3000ms
no response
Rinse and Repeat

TrendNet WAP -- TEW-753DAP CONFIG

Uplink port > Cisco GigabitEthernet1/0/22 (Trunk)
Spanning Tree Disabled on Trunk Uplink and WAP Uplink interfaces
--SSID 1 = VLAN100 | Devices connected to SSID1 retreive DHCP from a Sonicwall scope assigned to VLAN100
--SSID 2 = VLAN200 | Devices connected to SSID2 retreive DHCP from a Sonicwall scope assigned to VLAN200

The traffic from these SSID VLANs is isolated from one another to keep LAN and WAN traffic separated. *VLAN100's gateway defaults to a secondary failover WAN. *VLAN200's gateway defaults to the corporate WAN.

*VLAN200 is able to communicate directly with non-tagged (wired) corporate traffic.

CISCO 2960s Config

ws-c2960s-24ps-l
!
!
ip domain-name *******
vtp mode transparent
!
spanning-tree mode pvst
spanning-tree extend system-id
!
!
vlan internal allocation policy ascending
!
vlan 2
 name VoIP
vlan 10
 name management
!
vlan 100
 name Guest-WVLAN
!
vlan 200
 name Corporate-WVLAN
!
!
interface FastEthernet0
 no ip address
 shutdown
!
interface GigabitEthernet1/0/1
 description (EdgeDevice)
 switchport mode access
 switchport voice vlan 2
 spanning-tree portfast
 spanning-tree bpduguard enable

***********SAME INTERFACE CONFIG 1/0/1 -- 1/0/20***********
!
!
interface GigabitEthernet1/0/21
 description (TRUNK ENABLED)
 switchport mode trunk
 shutdown
!
!
interface GigabitEthernet1/0/22
 description (Uplink - TRUNK to WAP)
 switchport mode trunk
!
!
interface GigabitEthernet1/0/23
 description (TRUNK ENABLED)
 switchport mode trunk
 shutdown
!
!
interface GigabitEthernet1/0/24
 description (Uplink - Trunk to Core Switch)
 switchport mode trunk
!
!
interface GigabitEthernet1/0/25
 description (Fiber - TRUNK ENABLED)
 switchport mode trunk
 shutdown
!
!
interface GigabitEthernet1/0/26
 description (Fiber - TRUNK ENABLED)
 switchport mode trunk
 shutdown
!
!
interface GigabitEthernet1/0/27
 description (Fiber - TRUNK ENABLED)
 switchport mode trunk
 shutdown
!
!
interface GigabitEthernet1/0/28
 description (Fiber - TRUNK ENABLED)
 switchport mode trunk
 shutdown
!
!
interface Vlan1
 ip address *.*.*.* 255.255.255.0
!
interface Vlan2
 no ip address
!
interface Vlan10
 ip address *.*.*.* 255.255.255.0
!
interface Vlan100
 ip address *.*.*.* 255.255.255.0
!
interface Vlan200
 ip address *.*.*.* 255.255.255.0
!
ip default-gateway *.*.*.*
!
!
logging trap debugging
logging host *.*.*.*
!
!
ntp server *.*.*.*
end
Improve this question
2

The 2960s is an access switch with very limited L3 capabilities and you really want the Layer 3 vlan interfaces (SVIs) on a better performing Layer 3 switch acting as your core where you can implement ACLs on the L3 SVIs.

After removing all the wireless SVIs in your 2960 switch modify the trunk interface to your wap.

This part to your WAP needs a slight modification:-

interface GigabitEthernet1/0/22 description (Uplink - TRUNK to WAP) switchport mode trunk switchport trunk native vlan ?? switch port trunk allowed vlan 100,200 spanning-tree portfast trunk

Not too sure how the trendnet is communicating with the switch over the trunk interface but this support page mentions it's administration is by default over PVID 1:-

http://www.trendnet.com/support/view_faq_question.asp?ToDo=view&questId=2874&catId=695&iframe=true

Not too sure how you've configured your WAPs to broadcast on the channels and how many you have deployed but you could post your infrastructure here for everyone to help.

Improve this answer
  • The VLAN configuration on these WAPs is minimal with very little to actually modify. You basically create your SSIDs \ click a checkbox for VLAN \ enter a TAG ID \ click save. The channels are set to AUTO \ 24 hour update. We have 6 WAPs across 3 buildings. To confirm, you recommend I enable STP & implement a VLAN ACL on the CISCO trunk interface that uplinks to the WAPs?? **Should I also enable STP on the Trendnet WAPs also? Trendnet has online emulators for their devices if you want to see it: trendnet.com/emulators/tew-753DAP_v1.0R/cgi-bin/luci.html – CWB Aug 30 '16 at 20:50
  • While I generally agree with your suggestions, I doubt they are the cause of the problem. – Ron Trunk Aug 30 '16 at 20:58
  • You should never disable spanning tree unless your network engineer has valid reasons to. For vlan isolation Layer 3 ACLs should be implemented on your core/distribution switch where you've implemented the SVIs and not on the access switch. You mentioned 6 WAPs accross 3 buildings, can you post a schema/drawing of you wireless infrastructure. Many here have extensive experiences. – user4565 Sep 1 '16 at 20:52
  • Spanning-Tree is disabled because nearly everything I've read says to on trunks that aren't configured as redundant paths. The plan is to get a 3750-X and perform some testing. I've had several people review the config and mention the VLAN isolation with ACLs (which I had already implemented in the very beginning and it didn't help) and everyone points back to the older hardware. I really appreciate the info and will report back once the new hardware is in place. – CWB Sep 6 '16 at 15:18
  • @CWB - I concur with implementing a 3750x if you have spares. The 3850 series appears to have now replaced the 3750x series for ordering. cisco.com/c/en/us/products/collateral/switches/… – user4565 Sep 6 '16 at 20:06
1

The resolution in the end was to swap to the Cisco 3560G switches + disabling Frame Aggregation on the Trendnet WAPs. This made the pings\latency stable along with improved data transfer speeds.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.