3

I manage a wireless network of 50 Aironet 1130AG access points spread across 8 Catalyst switches. This ran very smoothly until I had to employ VLAN tagging. There is now the passwordless Default (1) and a new VLAN (300) with WPA2.

The switch ports across the switches are set to trunk mode except the gateway port where the VLAN 300 router resides.

After this maneuver, the whole network slowed down to a crawl. I lack experience with managing VLANs, so I am hoping someone could give me some advice in what might have caused this hit to performance.

-- AP Config --

version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname SSH-WL01
!
enable secret 5 ****
!
no aaa new-model
no ip igmp snooping
ip domain name SSH
!
!
no dot11 igmp snooping-helper
dot11 vlan-name Otrum vlan 300
dot11 vlan-name default vlan 1
!
dot11 ssid OpenNet
   vlan 1
   authentication open
   guest-mode
   mbssid guest-mode
   infrastructure-ssid optional
!
dot11 ssid otrum
   vlan 300
   authentication open
   authentication key-management wpa version 2
   mbssid guest-mode
   wpa-psk ascii 7 ****
!
dot11 network-map
power inline negotiation prestandard source
!
!
username admin privilege 15 secret 5 ****
!
bridge irb
!
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption vlan 300 mode ciphers aes-ccm tkip
 !
 ssid OpenNet
 !
 ssid otrum
 !
 mbssid
 station-role root
!
interface Dot11Radio0.1
 encapsulation dot1Q 1 native
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface Dot11Radio0.300
 encapsulation dot1Q 300
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface Dot11Radio1
 no ip address
 no ip route-cache
 !
 encryption vlan 300 mode ciphers aes-ccm tkip
 !
 ssid OpenNet
 !
 ssid otrum
 !
 no dfs band block
 mbssid
 speed  basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 basic-54.0
 channel dfs
 station-role root
!
interface Dot11Radio1.1
 encapsulation dot1Q 1 native
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface Dot11Radio1.300
 encapsulation dot1Q 300
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface FastEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
!
interface FastEthernet0.1
 encapsulation dot1Q 1 native
 no ip route-cache
 bridge-group 1
 no bridge-group 1 source-learning
 bridge-group 1 spanning-disabled
!
interface FastEthernet0.300
 encapsulation dot1Q 300
 no ip route-cache
 bridge-group 255
 no bridge-group 255 source-learning
 bridge-group 255 spanning-disabled
!
interface BVI1
 ip address 172.16.0.1 255.255.0.0
 no ip route-cache
!
ip default-gateway 172.16.254.254
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
snmp-server community SSH RO
snmp-server location Badehuset
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
 login local
!

end

-- Switch Config --

version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ssh-sw01
!
boot-start-marker
boot-end-marker
!
enable secret 5 ****
enable password ****
!
username admin privilege 15 secret 5 ****
no aaa new-model
system mtu routing 1500
ip subnet-zero
!
!
ip domain-name ssh.local
cluster enable Cluster1 0
!
!
crypto pki trustpoint TP-self-signed-4237220096
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-4237220096
 revocation-check none
 rsakeypair TP-self-signed-4237220096
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
interface FastEthernet0/1
 switchport mode trunk
!
interface FastEthernet0/2
 switchport mode trunk
!
interface FastEthernet0/3
 switchport mode trunk
!
interface FastEthernet0/4
 switchport mode trunk
!
interface FastEthernet0/5
 switchport mode trunk
!
interface FastEthernet0/6
 switchport mode trunk
!
interface FastEthernet0/7
 switchport mode trunk
!
interface FastEthernet0/8
 switchport mode trunk
!
interface FastEthernet0/9
 switchport mode trunk
!
interface FastEthernet0/10
 switchport mode trunk
!
interface FastEthernet0/11
 switchport mode trunk
!
interface FastEthernet0/12
 switchport mode trunk
!
interface FastEthernet0/13
 switchport mode trunk
!
interface FastEthernet0/14
 switchport mode trunk
!
interface FastEthernet0/15
 switchport mode trunk
!
interface FastEthernet0/16
 switchport mode trunk
!
interface FastEthernet0/17
 switchport mode trunk
!
interface FastEthernet0/18
 switchport mode trunk
!
interface FastEthernet0/19
 switchport mode trunk
!
interface FastEthernet0/20
 switchport mode trunk
!
interface FastEthernet0/21
 switchport mode trunk
!
interface FastEthernet0/22
 switchport mode trunk
!
interface FastEthernet0/23
 switchport mode access
!
interface FastEthernet0/24
 switchport access vlan 300
 switchport mode access
!
interface GigabitEthernet0/1
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/2
 switchport mode trunk
!
interface Vlan1
 ip address 172.16.1.1 255.255.0.0
 no ip route-cache
!
interface Vlan10
 ip address 172.17.1.1 255.255.0.0
 no ip route-cache
!
interface Vlan300
 ip address 172.19.1.1 255.255.0.0
 no ip route-cache
!
ip http server
ip http secure-server
!
snmp-server community public RO
snmp-server community public@es0 RO
!
control-plane
!
line con 0
line vty 0 4
 password ****
 login local
 transport input ssh
line vty 5 15
 password ****
 login
!
end
  • Please post the configurations. Are you using WPA2 personal or enterprise? – Ron Trunk Sep 16 '16 at 12:47
  • There.. I updated the initial question with the AP and switch configs. The WPA2 is personal. – Bjørn H. Sandvik Sep 16 '16 at 13:11
  • Is the performance the same on both bands? – Ron Trunk Sep 16 '16 at 13:27
  • I have not yet tested that aspect. I am considering just shutting down the 802.11a band altogether. I'll get right on it in any event. – Bjørn H. Sandvik Sep 16 '16 at 13:41
  • I would guess the 5GHz band would have better performance and less interference tha the 2.4GHz band. You should use that if your clients have the capability. – Ron Trunk Sep 16 '16 at 13:42
2

Have you considered placing your wlc in a different location instead of off of the router in the router. From most of my experience with environments I've worked in we have always placed are wireless LAN controllers off of switches.

Spaced evenly throughout your network environment comma it would make much more sense from a traffic flow standpoint. It seems to me that if you are running a wlc behind a router that is also responsible for your whole networks routing that could cause a bottleneck?

I havent used a router in between the wlc and layer 3 switch stack in any environment most wireless lan controllers function fine at layer 2 with a vlan ip.

2

Without knowing what model the switches are, what is the default MTU on the interfaces? Often they default to 1500, and with the addition of the vlan tag you may be surpassing that. This could certainly manifest itself in the manner you described. A ping from one of the clients at increasing packet sizes will tell you (it would likely last reply at 1496).

To expound on this, reason this would be an issue now is that the VLAN header adds 4 bytes. Any decently sized flow (mostly anything consisting of more than a packet or 2) will come from the client and server (and from the Internet) at 1500 bytes. Those packets would then be getting dropped.

0

You should have radio .1 and vlan 1 in bridge-group 1. Build bridge-group 2 and put the radio.300 and sub interface for vlan 300 in it. Here's a document on [bridge-groups][

See if that helps. Otherwise start with the basics. Channel overlap, power levels are the first step (rf or physical layer of wifi).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.