1

I have inherited some Cisco Aironet 1042 fat APs and a network design of a flat, single VLAN (10).

To offer multiple SSIDs, the Cisco insists on a VLAN for each SSID.

By placing the interfaces against a bridge group, I am able to offer network access across all three SSIDs when the AP is connected to a simple port on Cisco the LAN configured as:

switchport access vlan 10
switchport mode access

Or on HP ProCurve configured as 

untagged

However, I have one AP (rather, one location- it occurs on any AP plugged there) that is connected behind two switches that refuses to pass traffic - UNLESS I have a dumb switch in front of it. All other APs that connect to a switch have had no issues- including one that is connected behind another switch.

This makes me think that the dumb switch is stripping VLAN identification off of it? Does that push it to VLAN 1 as the default? I don't see how that'd work given that the AP works just fine behind the dumb switch but not on the switch proper.

I'm not sure how to get this AP behind two switches working without the dumb switch.

The AP is plugged to a switch plugged to another switch and the connection between the switches is an untagged uplink.

Here is my config. Thoughts?

T-0060#show running-config
Building configuration...

Current configuration : 4101 bytes
!
! Last configuration change at 11:26:47 EDT Sun Aug 14 2016 by newlifeadmin
! NVRAM config last updated at 11:21:11 EDT Sun Aug 14 2016
! NVRAM config last updated at 11:21:11 EDT Sun Aug 14 2016
version 15.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname T-0060
!
!
logging rate-limit console 9
enable secret 5 #SECRET#
!
no aaa new-model
clock timezone EST -5 0
clock summer-time EDT recurring
no ip source-route
no ip cef
!
!
!
!
dot11 syslog
!
dot11 ssid RN Faculty
   vlan 10
   authentication open
   authentication key-management wpa
   mbssid guest-mode
   wpa-psk ascii 7 #SECRET#
!
dot11 ssid RN Guest
   vlan 30
   authentication open
   authentication key-management wpa
   mbssid guest-mode
   wpa-psk ascii 7 #SECRET#
!
dot11 ssid RN Students
   vlan 20
   authentication open
   authentication key-management wpa
   mbssid guest-mode
   wpa-psk ascii 7 #SECRET#
!
!
!
no ipv6 cef
!
!
username #SECRET# password 7 #SECRET#
username #SECRET# privilege 15 password 7 #SECRET#
username #SECRET# privilege 15 password 7 #SECRET#
!
!
bridge irb
!
!
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption vlan 10 mode ciphers aes-ccm tkip
 !
 encryption vlan 20 mode ciphers aes-ccm tkip
 !
 encryption vlan 30 mode ciphers aes-ccm tkip
 !
 ssid RN Faculty
 !
 ssid RN Guest
 !
 ssid RN Students
 !
 antenna gain 0
 mbssid
 station-role root
!
interface Dot11Radio0.10
 encapsulation dot1Q 10 native
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.20
 encapsulation dot1Q 20
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.30
 encapsulation dot1Q 30
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio1
 no ip address
 no ip route-cache
 !
 encryption vlan 20 mode ciphers aes-ccm tkip
 !
 encryption vlan 10 mode ciphers aes-ccm tkip
 !
 encryption vlan 30 mode ciphers aes-ccm tkip
 !
 ssid RN Faculty
 !
 ssid RN Guest
 !
 ssid RN Students
 !
 antenna gain 0
 peakdetect
 dfs band 3 block
 mbssid
 channel dfs
 station-role root
!
interface Dot11Radio1.10
 encapsulation dot1Q 10 native
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio1.20
 encapsulation dot1Q 20
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio1.30
 encapsulation dot1Q 30
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface GigabitEthernet0
 no ip address
 duplex auto
 speed auto
 bridge-group 1
 bridge-group 1 spanning-disabled
 no bridge-group 1 source-learning
!
interface BVI1
 mac-address ccef.484c.bab0
 ip address 192.168.1.60 255.255.255.0
!
ip default-gateway 192.168.1.254
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
!
!
bridge 1 route ip
!
!
!
line con 0
 login local
line vty 0 4
 login local
 transport input all
!
end

T-0060#
Improve this question
6
  • It may be that the switch and AP are using CDP to negotiate something. It really makes no sense to bridge the different SSIDs together because you are really complicating a situation that is a single SSID since all the traffic is mixed. In the fashion, SSIDs are the equivalent of wired VLANs, and you are just bridging VLANs. Why, then, would you even have VLANs? SSIDs and VLANs give you some security, but you are bypassing that.
    – Ron Maupin ♦
    Sep 12, 2016 at 14:37
  • It's a less than perfect design that is required to be had- multiple SSIDs but there is only one VLAN on the backend. Security isn't the issue here, just devices that have SSID passwords that rotate on different schedules.
    – Greg Esposito
    Sep 12, 2016 at 15:39
  • I just don't see a benefit in multiple SSIDs if all the traffic is going to the same place. SSIDs (and VLANs) allow you to set up security, but your Faculty, Guests, and Student all have the same network access to the same stuff. You could just simplify it with a single SSID. Students or guests can attack faculty users.
    – Ron Maupin ♦
    Sep 12, 2016 at 15:44
  • Don't you need secondary and tertiary IP addresses on the BVI? A unique gateway address per VLAN/subnet? Also, where is the DHCP server?
    – Ronnie Royston
    Sep 12, 2016 at 16:17
  • @GregEsposito respectfully, this config while clever is a mess. Just have a single SSID if all you have is a single LAN/VLAN. KISS Principle.
    – Ronnie Royston
    Sep 12, 2016 at 16:19

2 Answers 2

Reset to default
1

If you want to do a quick and dirty hack, just loop back the VLANs into each other on a switch. Just add two untagged/access ports in VLAN10, and one for VLAN20 and VLAN30, and just patch the ports together.

Very ugly, extremely sketchy, but it will work as long as you don't have Spanning Tree enabled (and it will work even then if you put BPDU filtering on the ports). But as others have said already, the point of having multiple SSIDs is to separate traffic, if you feed everything into the same network there's not really any point of having multiple SSIDs.

Improve this answer
0

This AP is working directly connected to an HP switch with no VLAN settings at all, rather than being untagged. Not the best solution, but accomplishes all goals without needing to have to make any changes to APs/Switches/VLANs.

For me, the solution was to remove the untagged VLAN on the port.

Improve this answer
1
  • An HP switch default is untagged vlan 1. An HP switch port needs either tagged or untagged of some vlan to work (they all do its just programmed differently on diffrent brands). It's not like Cisco where you can make a trunk port to allow tags for all vlan and untagged 1 (default native is 1) or access port (untagged vlan 1 unless specified). Do a 'show vlan port A1 details'. Put your port number in place of A1. Then you can see how its set up and working just so you know for future.
    – Fixitrod
    Aug 15, 2017 at 23:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.