3

My question is about addressing a Cisco router interface so that I can use both bridging through an access point as workgroup-bridge and also connect to the access point to configure it.

Apologies for such a long (first!) post: the question is short but the context is long!

Purpose: I have routers installed for telemetry but unfortunately the uplinks, normally ADSL or PPPoE/fibre, are sometimes months in coming and we need to find interim methods to connect. In one particular site, we have good wifi so I want to use that. I control the router, the AP, the PCs; I don't control the wifi supply (infap etc in diagram below.)

Question: How do I configure the AP/router so that both bridging through to the gw and direct router-AP traffic works?

Bench I have it working, with the exception of the problem I'm asking about, on the bench with available old parts.

  • Cisco 837 router running 12.3(14)T7
  • Cisco 1231G-E-K9 access point running 12.3(8)JEC3
  • Upstream wifi and internet connection all working, not in my control

I'd like to use this AP as I have lots of them; the real routers are typically 867VAE-K9 running C860VAE-ADVSECURITYK9-M Version 15.5(3)M.

Diagram

       \|/ - - - - - - - - - - - - \|/           INTERNET 
        |                           |             |
        ap                         infap   dhcpd  gw
    bvi1|.2      10.0.0.0/24        |        |    |  
   =+===+==========                =+========+====+====
  e2|dhcp
   router+NAT
  e0|.1          192.168.13.0/24
====+====+====+====
         |.32 |.33
         pc   pc  ...

Behaviour

The AP correctly associates; the router can get DHCP through int e2 and default route to gw so the goal is achieved. But then router can't ssh to the AP to configuration it. If int e2 is set to static 10.0.0.1, ssh to AP on 10.0.0.2 works fine, but obviously internet connection doesn't.

With int e2 as DHCP we get a correct lease with correct default route to gw but we don't know what address that will be.

So I tried having both ip address dhcp and ip address 10.0.0.1 255.255.255.0 secondary, but it's not permitted.

On the bench I just change to ip address 10.0.0.1... to adjust the AP, but can't do that when live because it would be a Daffy-Duck-Saws-Branch-He's-Sitting-On moment.

There's a trick I'm missing somewhere surely!

All suggestions gratefully received,

Jonathan.

Trimmed configs appended:

Router:

This is Cisco 837 ADSL router, has a 4-port 10/100 switch, with FE1,2,3 connected to ethernet0 and FE4 connected to ethernet2.

interface Ethernet0
 ip address 192.168.13.1 255.255.255.0
 ip nat inside
!
interface Ethernet2
 ip address dhcp
 ip nat outside
!
ip nat inside source list NATLIST interface Ethernet2 overload
!
ip access-list standard NATLIST
 permit 192.168.13.0 0.0.0.255

Access point:

bridge irb
interface Dot11Radio0
 no ip address
 no ip route-cache
 ! encryption mode speed ssid omitted: associates fine
 station-role workgroup-bridge
 bridge-group 1
 bridge-group 1 spanning-disabled
!
interface FastEthernet0
 no ip address
 no ip route-cache
 bridge-group 1
 bridge-group 1 spanning-disabled
!
interface BVI1
 ip address 10.0.0.2 255.255.255.0
 no ip route-cache
!
bridge 1 route ip
Improve this question
5
  • Since you have private addresses on both sides of the router, why are you using NAT? You only use NAT if you must, and the router can route between those two networks without NAT. That simply complicates things without giving you anything.
    – Ron Maupin ♦
    Commented Oct 2, 2017 at 13:24
  • Hi ... bottom side has required addresses; top side would put anything that works for contacting the AP. We don't know what addresses wifi will give router, but they are quite possibly public and/or changing. Also, my understanding is many wifi installations expect to see only a single host under the wifi. The only solution I can see at present to my addressing problem is to make the both the AP and router get DHCP from wifi's dhcpd, and then hunt for the address of the AP -- which seems horrible. Anything proper you can think of? Thanks, J.
    – jonathanjo
    Commented Oct 2, 2017 at 20:04
  • ... and taking another look, the NAT doesn't affect the question as far as I can tell, as the issues is about making connections from e2 to ap and e2 to public address bridged through AP to gw. The NAT is performing some functions for the underneath eg pc. In any case the NAT works fine as implemented. Thanks again. J.
    – jonathanjo
    Commented Oct 2, 2017 at 20:09
  • I wasn't answering the question; I was making a comment about NAT. Routers route between networks, and NAT really isn't necessary, or desired, unless you must use it, e.g. Private<->Public addressing. NAT complicates things, and it breaks the IP end-to-end paradigm. Normally, you would NAT at the Internet gateway, and it looks like you could get double-NAT, which is even more problematic.
    – Ron Maupin ♦
    Commented Oct 2, 2017 at 21:05
  • ... I agree, certainly NAT is undesirable if not absolutely required, and double-NAT even worse.
    – jonathanjo
    Commented Oct 3, 2017 at 13:07

1 Answer 1

Reset to default
3

The trick is getting the router to appear on 10/24. DHCP and secondary addressing requires a bunch of VLAN Magic(tm). Assuming no one wants to get that messy... adding routes on the router and ap should get you where you want to be.

The problem you have with the bridge is that the AP will not "see" the traffic it's bridging, as at layer-2 the traffic doesn't belong to the AP -- your attempt to talk to 10.0.0.2 goes to the ISP (bridged) gateway. An interface route on the router will stop that: ip route 10.0.0.0 255.255.255.0 e2 As the AP has no routes at all, it needs to know where 192.168.13.0/24 lives (bvi1) AND the router has to be configured to not NAT traffic to/from 10/24.

Improve this answer
5
  • 1
    Ricky -- The static route on the router worked perfectly. I changed to link local addresses: int bvi1 ip address 169.254.0.2 255.255.255.252 and host route on the router ip route 169.254.0.2 255.255.255.255 ethernet 2 ... The non-routing on the AP is puzzles me -- the arbitrary DHCP address/mask on e2 can ssh to non-local /30 on AP; I suppose it's just a bridge! NAT not affecting this, we ssh to router then ssh (from outside int) to AP, more than adequate. Huge thanks. J.
    – jonathanjo
    Commented Oct 3, 2017 at 12:57
  • ps re VLANs -- yes, I'd worked out we should be able to bridge one VLAN and not another. I was certainly hoping to avoid the complexity if not absolutely required. (And in this specific I'd have to get a different router for testing, easy enough but undesirable, as old 837 has no VLANs.)
    – jonathanjo
    Commented Oct 3, 2017 at 13:00
  • 1
    Yeah, Cisco should be shot for not allowing access to add routes. Even hosts sometimes need specific routes.
    – Ricky
    Commented Oct 4, 2017 at 6:11
  • Now I'm puzzling over how to limit ssh access to the access point, which normally is locked to certain IP addresses (ie the router, not the wifi side) ... but AP doesn't know the IP address of the router, which comes from DHCP.
    – jonathanjo
    Commented Oct 4, 2017 at 8:37
  • per re-reading RFC 3927, link-local addresses are really for automatic config and "SHOULD NOT" be assigned manually on AP (see my previous comment). Probably best to stick to 10.0.0.2/30 or similar. Note however we're at the mercy of the DHCP which we don't control, which might clash if we're unlucky.
    – jonathanjo
    Commented Oct 4, 2017 at 9:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.