2

I am struggling and I don't really know what I need to setup my network.

I have a Cisco router C1111-8p (8 switch ports) and a wifi AP C1832.


                         +---------------+
    +----------+         |               | trunk port             +--------------+
    |          |         |               |                        |              |
    |ISP modem +-------->+0/0/0          +------------------------+  WIFI AP     |
    |          |         |             0/1/0                      |  SSID10      |
    +----------+         |               +------------------------+  SSID20      |
                         |               |   VLAN 10 for SSID10   |              |
                         |  0/1/1        |   VLAN 20 for SSID20   |              |
                         +---------------+                        +--------------+
                             |
                             |
                       +------------------+
                       |      SERVER      |
                       +------------------+

  • 0/1/* are the 8 switch ports
  • GigabitEthernet 0/0/0 is the WAN port

I'd like a different subnet for each VLAN for each SSID:

  • SSID10 on VLAN 10 with 10.10.10.0/24
  • SSID20 on VLAN 20 with 10.10.20.0/24
  • Everything else on 10.10.1.0/24

Everybody should access the Internet.

Here is my current configuration:

# Setup ISP internet connection
configure terminal
interface GigabitEthernet 0/0/0
ip address 219.a.b.c 255.255.255.252
no shutdown
ip route 0.0.0.0 0.0.0.0 219.a.b.d

#Setup the trunk port for the Wifi AP
configure terminal
interface GigabitEthernet 0/1/0
switchport mode trunk
switchport trunk native vlan 1
switchport trunk allowed vlan add 1,10,20
switchport nonegotiate
no shutdown

# Setup the switch port for the server that will host RADIUS and SQUID
configure terminal
interface GigabitEthernet 0/1/1
switchport mode access
ip address 10.10.1.1 255.255.255.0

# Configure VLANs
configure terminal
vlan 10
vlan 20
interface vlan 10
ip address 10.10.10.1 255.255.255.0
no shutdown
vlan 20
interface vlan 20
ip address 10.10.20.1 255.255.255.0
no shutdown

Question 1:

  • Do I need to setup a DHCP for each VLAN? A single DHCP server? What's the difference with a DHCP pool?
    • Should I exclude subnet of VLANs? ip dhcp excluded-address
    • Should I create a different pool for each VLAN subnet?

Question 2:

  • How the AP is working with all the VLANs and native VLAN?
    • I set the native VLAN at 1 in both router and AP.

Question 3:

  • Will the AP be able to access the RADIUS/SQUID server in a different subnet 10.10.1.0/24?
5
  • It is very bad form to change the question, especially after you have an answer for what you originally asked. Your new question is unclear. What do you mean by, "What about the NAT?" You have not explained anything about NAT or even that you need NAT on any interface. That is really a different subject for which you should ask a different question.
    – Ron Maupin
    Apr 25, 2019 at 4:31
  • Q1: yes, you need to create a dhcp pool for each subnet/vlan. You can call it VLAN10 and VLAN20, for instance: ip dhcp pool VLAN10 and ip dhcp pool VLAN20 and then configure your subnets as described.
    – Cow
    Apr 25, 2019 at 6:18
  • @Ron Maupin Sorry, I will create a new question.
    – Alexis
    Apr 25, 2019 at 6:47
  • @user56700 I created these VLANs but there is something I don't understand. If I don't want to use any VLAN, how can I do? I mean, I don't want the Radius server to be connected to a VLAN. Unless a VLAN is compulsory in a router.
    – Alexis
    Apr 25, 2019 at 6:49
  • @Alexis_FR_JP if you dont want to use the VLANs for the RADIUS, then how would you like to connect it to your network?
    – Cow
    Apr 25, 2019 at 6:57

1 Answer 1

2

If interface GigabitEthernet 0/1/1 is a switch interface, you will not be able to assign an IP address to it. You need to assign the address to the SVI the way you did for the other VLANs. The default VLAN is VLAN 1, and it is the native VLAN by default.

You do need a DHCP pool for each VLAN. If the DHCP server is not the one in the router, you must use DHCP relay (ip helper-address) on the SVIs for the VLANs to which the DHCP server is not connected; this is not necessary if you use the router DHCP server. You exclude any addresses in the DHCP pool for each VLAN that are statically configured on devices. If you use the router DHCP server, you do not need to do that for the router interface because the router will automatically do that for you.

The WAP will get its management address from the native VLAN. You could use DHCP, but you would normally want to statically assign that address (exclude from the DHCP pool). You then configure each SSID to one of the tagged VLANs on the trunk between the switch interface and the WAP.

The WAP and the server will be on the same VLAN (VLAN 1), so, yes, the WAP and server can directly communicate through the switch because they will be addressed on the same network and VLAN.


Edit for the new question about NAT:

You make any interfaces, including SVIs, that need to use NAT as either inside or outside interfaces, depending on your needs. If you want the VLANs with Private addresses to be able to use the public Internet, then the interface connected to the Internet should be an outside interface, and the VLAN SVIs should be inside interfaces, and the NAT ACL should include those networks.

2
  • I use the router's DHCP server. What about the other devices such as the server that doesn't belong to any VLAN? Do I need a common/general DHCP pool?
    – Alexis
    Apr 25, 2019 at 4:29
  • The server is connected to the switch on VLAN 1. You need a DHCP pool fo every network wherre you have hosts that must be configured via DHCP. If you only have the server and WAP on VLAN 1, then you can statically define those and not need DHCP for that VLAN, but if you connect other devices, e.g. PCs, to the other switch interfaces on VLAN 1, then you should use DHCP for that VLAN, too.
    – Ron Maupin
    Apr 25, 2019 at 4:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.