ExtremeWireless (WiNG)

I have two AP-7522 access points. Both have version 5.9.1.4-004R. Both receive their power and network through a Symbol AP-PSBIAS-2P2-AFR "brick". I set the country name to "United States-us" on both because I read the radios will not turn on until you do.

AP#1 - This is the "host" access point connected to the wired LAN with access to the internet. The internal network is 192.168.1.0/24. I've given this AP the IP address 192.168.1.101. I configured a wireless network with SSID "myWireless", Secure-PSK, WPA2-CCMP, and the key is "myWirelessKey". Radio 1 is 2.4GHz, radio 2 is 5GHz.

AP#2 - This is the "client" access point that I want to bridge to AP#1. I have AP#2 connected to an unmanaged 5 port switch, which also connects a desktop PC. It's this desktop PC that needs access to the internet. I've given this AP the IP address 192.168.1.101. For the bridging configuration I followed the directions here (https://extremeportal.force.com/ExtrArticleDetail?an=000082884)

• en
• conf t
• profile
• interface radio 2
• rf-mode bridge
• bridge ssid myWireless
• bridge vlan 1
• bridge encryption-type ccmp
• bridge authentication-type none
• bridge wpa-wpa2 psk 0 myWirelessKey
• no bridge eap username
• no bridge eap password
• bridge eap type peap-mschapv2
• bridge roam-criteria missed-beacons 20
• bridge roam-criteria rssi-threshold -75
• bridge channel-list 5GHz 36,40,44,48
• bridge channel-list 2.4GHz
• comm wr

However when I run "show wireless bridge candidate-ap" it reports 0 candidate APs. AP#1 shows no wireless clients. The workstation can successfully ping AP#2 and vice versa. I am able to reach the web interface and ssh on AP#1 on the 192.168.1.0/24 network. But AP#1 can't ping AP#2 and vice versa. Nothing on the 192.168.1.0/24 network can ping AP#2 or the desktop PC. The desktop PC cannot reach anything on the 192.168.1.0/24 network.

Right now both APs are in the same room, 10 feet from each other, no physical obstacles between them.

In my searching I also found (https://extremeportal.force.com/ExtrArticleDetail?an=000063492) I tried the solution there but it didn't help.

Does anyone know what I'm doing wrong, or what I'm missing?

Additional questions:
1 - Do I have to configure any bridging properties on the AP#1 that is connected to the wired network with internet access? None of the guides I've read mention anything about configuration on the "host" AP, but since I can't get this working I'm wondering if some configuration is necessary on AP#1.

2 - Do I have to load a special firmware version to be able to access bridging configuration in the web GUI? Right now none of those configuration options are there and I have to do everything through ssh/command line. I know this was the case for some APs in the past that didn't have a web GUI at all and you had to download the firmware that included the GUI.

Thanks for any help you can provide!
Aaron

Good info, Aaron.

First...I'm hoping it was just a typo, but you seem to be indicating that you setup both APs with a static address of 192.168.1.101
If that's the case, it shouldn't be causing the primary problem....but it's still an issue that would need correcting.

If you followed that billeted list of commands, I see one major potential issue (not sure why they included this one command).
This one:

• bridge channel-list 5GHz 36,40,44,48

With this command, you're setting up the client-bridge AP so that it will only ever look for host APs that are operating on those 4 channels. If there are none nearby on those channels though, it will never be able to connect to anything, right?
I'd highly recommend including all of the possible channels that your 'host' APs are capable of operating on (or if statically assigned, those channels)
Or....set the Channel to "Smart"...which will more directly reflect how a normal wireless client behaves....it scans all channels looking for APs.

1 - Do I have to configure any bridging properties on the AP#1 that is connected to the wired network with internet access? None of the guides I've read mention anything about configuration on the "host" AP, but since I can't get this working I'm wondering if some configuration is necessary on AP#1.
Answer: NO. When setting up client-bridge APs, the only work that needs to be done is on the client-bridge APs themselves.

2 - Do I have to load a special firmware version to be able to access bridging configuration in the web GUI? Right now none of those configuration options are there and I have to do everything through ssh/command line. I know this was the case for some APs in the past that didn't have a web GUI at all and you had to download the firmware that included the GUI.
Answer: The very early releases of WiNG code (if I recall correctly) only allowed for the client-bridge setup via the CLI. The newest versions of WiNG code allow for full configuration via the GUI.

Thanks for your help Chris!

"bridge channel-list 5GHz smart" did not work, but that's no problem.

Should I enter "bridge channel-list 5GHz" and leave the rest of the command empty?
Or should I enter "no bridge channel-list 5GHz" assuming that if that option isn't configured that the AP will use its defaults?

[That GTAC article has now been corrected - and new screenshots as well]

Just go into the radio 2 interface and issue the command:
no bridge channel-list 5GHz
commit write

Then run the command again to see what candidate APs it's finding:
show wireless bridge candidate-ap

If it's showing APs now, it should be connecting to the one it thinks is best. Once it's connected, run this to see the stats of the client-bridge connection
show wireless bridge statistics

Unfortunately that didn't fix it either. Total number of candidates displayed is still 0.

Do I need to be creating or editing a specific profile? In my bulleted list of commands I originally posted, the third command is "profile" which enters me into the context "ap7522-A81950(config-profile-{ALL})". Then I enter "interface radio 2". But when I enter the command "rf-mode bridge" there I get the error "rf-mode bridge is not supported on radio2 of anyap"

But if I instead use "profile ap7522 PROFILE-AP7522", then "interface radio 2", and then "rf-mode bridge", it accepts the command.

But how do I know what profile the AP is using? If I enter "profile ?" it lists a few available, but I didn't create any of them. Profiles "anyap", "ap7522", "ap7532", and "ap7562" are available. I didn't create "PROFILE-AP7522" either. Is it ok to use it?

Sorry for these novice questions, this is the first time I've had to work this in-depth with these access points. I'm grasping at straws at this point.

By the way, to address your question from your first post, I did make a typo with the 192.168.1.101 address. AP#2 has 192.168.1.102

Okay...so if this being done w/o a controller (just configuring the AP as a stand-alone device), then your command where you specified the 7522 profile is correct.

So the commands would look like this:

en conf t profile ap7522 PROFILE-AP7522 interface radio 2 rf-mode bridge bridge ssid myWireless bridge vlan 1 bridge encryption-type ccmp bridge authentication-type none bridge wpa-wpa2 psk 0 myWirelessKey comm wr

All of the other commands you don't see there now are NOT needed in your case.

To answer your question about which Profile is being used:
The Profile name "PROFILE-AP7522" I think is the default one, in which case...it should be be being used...by default.
If you want to confirm this, go into the CLI and do this:

en self show context

You should see an entry in there that says, "use profile PROFILE-AP7522"
If you see that it's configured to use some other Profile name, then that's the problem.

By the way, this "self" section is the device override section of the AP's config. This is where you setup any configuration settings that DEVIATE from the 'master' Profile. This is where you would go in the CLI to enter things that are different or unique about this one AP...things like the AP's static IP address or it's hostname.
If there are any settings that exist in *both* the override section and in the main Profile, the AP will use the setting in the override section. The settings in that section *override* what's in the main Profile.
Sometimes this catches people off-guard...because they have a setting in the override section, but when they try to change its value in the main Profile, nothing changes. 🙂 They instead need to change the value for that setting in the override section.

The entry says "use profile default-ap7522". How can I switch it to use PROFILE-AP7522?

How can I perform a factory reset to get back to the default configuration? Do I log in as user "reset" and password "FactoryDefault" ? I've tried so many things, one of my previous attempts to fix the problem might actually be causing me problems at this point and I need to start from a clean slate.

Aha...so there's the issue then.

Command to change this:

• en
• self
• use profile PROFILE-AP7522
• commit write

As long as you're in the override section, what else is in there? Just want to make sure there's nothing else that is going to mess things up.

Update: I issued the command "use profile PROFILE-AP7522" and now "show context" reports that profile is being used. Still have zero candidate APs though.

I'm looking at the output of "show running-config" and PROFILE-AP7522 doesn't have any "vlan 1" entries in it. I entered the vlan commands from the bulleted list though. Is this an issue?

I should've remembered that too.
Any time you create a new Profile....it doesn't come pre-populated with VLAN-1. You need to manually add it if you need it on the AP.

In this case, you need to go into the Profile and create the VLAN-1 entry:

en config t profile ap7522 PROFILE-AP7522 interface vlan 1 commit write optionally - ip address 192.168.1.102/24 (you could also enter this address in the override section) commit wr

This missing VLAN-1 entry shouldn't stop the AP from being able to discover candidate APs though.
What other entries are there in the self (override) section?

What is the output of:

show wireless radio

I log in via ssh, then enter the commands "en", then "self", then "show context". Below is the output. I'm typing this by hand, not copy/paste, as this is the desktop PC connected to AP#2 and it doesn't have internet access. Might be typos, I'll do my best to proofread.

I gave the wired interface ge1 the IP address 192.168.1.102/24. Is that going to conflict with anything we're adding to this profile PROFILE-AP7522 ?

• ap7522 B8-50-01-A8-19-50
• use profile PROFILE-AP7522
• use rf-domain default
• hostname ap7522-A81950
• ip default-gateway 192.168.111.1
• interface vlan1
• description "WAN Interface"
• ip address 192.168.111.102/24
• no ip dhcp client request options all
• no shutdown
• no virtual-controaller
• rf-domain-manager capable
• ip dns-server-forward
• ip nat inside source list default-B85001A81950-nat precedence 1 itnerface vlan1 overload
• no adoption-mode

"show wireless radio"

RADIO RADIO-MAC RF-MODE STATE CHANNEL POWER #CLIENT
ap7522-A81950:R1 B8-50-01-EB-D7-50 2.4GHz-wlan Off N/A (smt) 21 (smt) 0
ap7522-A81950:R2 B8-50-01-EC-51-C0 bridge On 48w (smt) 20 (smt) 0

This is starting to feel a little bit like a minefield situation (various settings in the config that I can't see that will cause issues). It might be easier and faster to simply default the AP and start from scratch so we'll at least know what we're dealing with.

Besides that though, questions:
Why is there a VLAN-1 entry in the override section that is on a different network? (192.168.111.0 vs 192.168.1.0)
Why is the nat entry there?

Sorry, another typo on my part. I'm actually using 192.168.111.0/24 but sanitized it to 192.168.1.0/24 in my first post, then forgot to sanitize it in other posts.

I don't know about the NAT entry. I didn't enter that. Did the AP automatically put that in there after I configured ge1 for 192.168.1.102/24?

I'll factory reset and start from the beginning, keeping in mind what we've discussed here, and I'll get back to you.

Should I run "delete startup-config" and then "reload" to return to factory settings?

Yep, that's it exactly. Just make sure after you issue the "reload" command that if you see a prompt asking if you want to save your settings before reloading that you say *NO*. 🙂

So radio 2 is showing the channel 48w entry. Seems like it may be connected.
Run again the command:
show wireless bridge statistics

Now the channel is 161w, then 64w. Seems like it's searching? "show wireless bridge statistics" is empty

Possibly. Not ever watched to see if that happens when it's not actually connected. if it is connected, the channel should stay the same...as long as it stays connected to same AP

Okay....if you're starting from scratch, this is what the CLI setup would look like.

en
config t
rf-domain default
country-code us
exit
profile ap7522 default-ap7522
interface radio 1
shut
interface radio 2
rf-mode bridge
bridge ssid myWireless
bridge encryption-type ccmp
bridge authentication-type none
bridge wpa-wpa2 psk 0 myWirelessKey
comm wr
self
interface vlan 1
ip address 192.168.111.102/24
exit
ip default-gateway 192.168.111.1
(Optionally) ip name-server [i]
commit write

I think that should be it.

I wish I would have seen your last post before I tried the config again. I messed something up and lost all remote access. I had been accessing over the 169.254.x.x IP address, or the 192.168.111.102 address. Now neither work. tcpdump shows no layer 3 traffic.

Is there a tiny paperclip hole on this unit anywhere that can be used for factory reset? This PC doesn't have a serial port, and I don't think I have an Ethernet to USB console cable...

Not sure what happened to cause the loss of layer-3 access....
No paperclip reset button on that AP though.
Only other thing I can think of is...to try to access it via MiNT from another WiNG AP.

Do you have another WiNG AP connected on the same layer-2 network?
If you do, log into that AP and issue the CLI command:
show mint neighbors

Unfortunately "0 mint neighbors" after I plug them into the same unmanaged 5 port switch

Thanks very much for your help today! I'll post again after I can find a console cable and run another factory reset, or fix whatever mistake I made.

I might not be able to get the proper console cable until I'm in my other office on Monday.

Have a great weekend

Sounds good, Aaron.
Once you are able to log back in, that list of commands I provided should have the AP setup and able to connect.

I actually found a working serial cable by chance. I factory reset the device again and entered the last config you provided me. Unfortunately it still isn't working.

I connected a laptop to AP#1 to ensure the wireless key was correct, and it worked successfully. I was able to reach the internet.

I'm going to go through the config line by line to see what the problem might be.

Output of:
show wireless bridge candidate-ap

If no candidates show up, then:
show wireless radio

If everything checks out and the AP continues to not see any APs to connect to, I'd actually be inclined to recommend a firmware update...just to make sure we're not dealing with some sort of unknown bug.

Also, if you could now...post a full copy of the running config. I'll 2x check it to make sure it's all setup correctly.

ap7522-A81950(config-device-B8-50-01-A8-19-50-if-vlan1)#show wireless bridge candidate-ap

B8-50-01-EC-D1-C0 Client Bridge Candidate APs:
AP-MAC BAND CHANNEL SIGNAL(dbm) STATUS

Total number of candidates displayed: 0
Total number of client bridges displayed: 1

ap7522-A81950(config-device-B8-50-01-A8-19-50-if-vlan1)#show wireless radio
----------------------------------------------------------------------------------------------
RADIO RADIO-MAC RF-MODE STATE CHANNEL POWER #CLIENT
----------------------------------------------------------------------------------------------
ap7522-A81950:R1 B8-50-01-EB-D7-50 2.4GHz-wlan Off N/A ( smt) 30 (smt) 0
ap7522-A81950:R2 B8-50-01-EC-D1-C0 bridge On 161 ( smt) 20 (smt) 0
----------------------------------------------------------------------------------------------
Total number of radios displayed: 2

Getting the full config now....

Full config:

!
! Configuration of AP7522 version 5.9.1.4-004R
!
!
version 2.5
!
!
client-identity-group default
load default-fingerprints
!
ip access-list BROADCAST-MULTICAST-CONTROL
permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"
permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"
deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"
deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"
deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"
permit ip any any rule-precedence 100 rule-description "permit all IP traffic"
!
mac access-list PERMIT-ARP-AND-IPv4
permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"
permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"
!
ip snmp-access-list default
permit any
!
firewall-policy default
no ip dos tcp-sequence-past-window
no stateful-packet-inspection-l2
ip tcp adjust-mss 1400
!
!
mint-policy global-default
!
meshpoint-qos-policy default
!
wlan-qos-policy default
qos trust dscp
qos trust wmm
!
radio-qos-policy default
!
!
management-policy default
telnet
no http server
https server
ssh
user admin password 1

I'm going to start working on a firmware upgrade now.

This all looks correct, Aaron. Hoping that the firmware upgrade gets things going at this point.

Apparently I have to be approved before I can download the latest firmware. Do you know if anyone is monitoring that over the weekend? I don't want to sit and watch my Inbox if nobody is going to get to it until Monday.

yes, there is weekend support. Someone should be able to help you with that.

Hey Aaron,

Can you test two things:
1. Can the host AP broadcast wlan whereby wireless client like mobile phone is able to scan?
2. Are these internal antenna or external antenna AP, if external, do make sure you have the antenna installed

1 - Yes, AP#1 is acting as an access point. I was able to use a laptop to successfully connect to the SSID myWireless and access the network/internet. I have not attempted the same thing with AP#2. I have only attempted client bridging with AP#2.

2 - The 7522 devices have external antennas. I do not currently have the external antennas installed on either AP#1 or AP#2. Are the external antennas required for client bridging?

Good catch by Madeline! Aaron, not a guarantee, but this could very likely explain what you're seeing. The lack of antennas may be causing the client-bridge AP to not be able to 'hear' any of the candidates APs. Easy to test though, right?

Currently I only have 2 antennas, the other 2 are delayed in shipping.

Should I install them on AP#2? Or put 1 antenna on each AP?

At the very least, you need them installed on the client-bridge AP.
Besides AP#1, are there any close-by APs that have that SSID setup on them that the AP#2 might be able to see and connect to?

If not, then I'd just try installing 1 antenna on AP#1 and AP#2.

I received a response to my request to access the most recent firmware version. I was told I have to first purchase a support contract. Is that really the case? Client bridging is supposed to be a supported feature, and we have to purchase a support contract to access the latest firmware that might fix an existing bug in the firmware that shipped with the AP? If that is the case I think we will have to return these 7522 access points and never purchase Extreme products again. I have not found the process of troubleshooting this issue to be frustrating, especially with the great help you and Madeline have provided, but I find that very frustrating.

I attached the 2 antennas to AP#2, then I reconfigured it to use other existing and known working wireless networks in our office. Neither worked, candidate-ap still is 0 in both cases.

I changed the following:

• en
• config t
• profile ap7522 default-ap7522
• interface radio 2
• rf-mode bridge
• bridge ssid NEWmyWireless
• bridge wpa-wpa2 psk 0 NEWmyWirelessKey
• comm wr

Then:

• en
• config t
• profile ap7522 default-ap7522
• interface radio 2
• rf-mode bridge
• bridge ssid NEW2myWireless
• bridge wpa-wpa2 psk 0 NEW2myWirelessKey
• comm wr

Any other ideas?

Aaron, I'll load up a 7532 (shouldn't be different than a 7522) with the same code you're running and configure it the same way. I'll see if I replicate the issue your seeing. That should tell us if this is a bug or not.

Aaron, I've configured a 7532 with the same firmware code and with the exact config setup that I recommended earlier. The bridge sees candidate APs and connects w/o issue.

Wondering if there's a hardware issue now. Can you (if you haven't already) try configuring the other AP as a client bridge AP. The likelihood that you have two bad APs is next to nill. These APs have an extremely low failure rate.

Thanks Chris, I will try that tomorrow morning

Should I change the configuration of AP#2 to be the "host" AP instead, broadcasting the "myWireless" SSID? If AP#2 does have a hardware problem, will that also affect its ability to act as the host to the client bridge AP?

If that is a possibility then I can try other wireless networks available in our office. My worry there is that I'm introducing other variables that are causing problems, such as a mismatch in encryption settings or something like that.

You could try that...since we're dealing with an unknown issue here though, I can't say how exactly it will behave...even if it IS a hardware issue. Won't hurt to try though.

When you make the switch though, setup the PSK and SSID to match that of existing APs on other *working* network where you're at though. If the AP isn't currently close enough to those other APs to be able to see them and connect, then go ahead and implement the configurations on the AP and then carry it to where it needs to be...along with your laptop and console cable so you can run those queries to see if it now sees candidate host APs.

Ok I've made some progress. #3 is what I need the most help on right now.

1 - The client bridge is partially successful right now. I switched the roles so now AP#2 is the "host" AP that is connected to the wired LAN, and AP#1 is the client bridge. I updated to firmware version 5.9.3 on both APs. I also have 1 antenna plugged into each AP. The client bridge reports that there is 1 candidate AP, and the "host" AP reports the client bridge AP as a wireless client. I introduced several variables here. If I get a chance later I'll factory reset both APs, remove all the antennas and try to set up the client bridge again with their original roles and report back. I know others might like to know if the firmware upgrade is what fixed the problem or not.

2 - Lesson learned: For a while I had both APs connected to the wired network so I could ssh into them instead of using the console port for terminal access. But once I got the client bridge successfully configured, that created a network loop / broadcast storm and brought down the network until I unplugged the client bridge AP from the wired network. The client bridge AP is connected to the 5 port unmanaged switch again, and the only other device connected to that is the Windows 10 workstation that needs internet access.

3 - The desktop on the "client bridge" side can't reach the rest of the 192.168.111.0/24 network or the internet. It is a Windows 10 workstation with a static IP address of 192.168.111.10. When I plug it directly into the wired network (not the 5 port unmanaged switch) everything works correctly. However when I re-attach it to the unmanaged 5 port switch that the client bridge AP is connected to, it self assigns a 169.254.x.y address instead of keeping its 192.168.111.10 address. There are errors in the Windows 10 event log "The system detected an address conflict for IP address 192.168.111.10 with the system having network hardware address B8-50-01-EC-D8-B0. Network operations on this system may be disrupted as a result." B8-50-01-EC-D8-B0 is the same MAC address I was seeing in packet captures during the network loop problem. I don't know where that's coming from because it doesn't match any of the 2 MAC addresses that AP#1 reports or the 2 MAC addresses that AP#2 reports when I run "show interface brief". But "B8-50-01" is registered to Extreme Networks.

Thoughts?

Some more information: I had a packet capture running on the Windows 10 workstation for a while. I see an ARP response from that B8-50-01-EC-D8-B0 MAC address stating that it belonged to 192.168.111.10.

I figured that the arp entry for the 192.168.111.10 address was still cached from when I had the workstation directly connected to the wired network and not though the 5 port switch / wireless client bridge. So I'm restarting both APs to clear their arp tables.

Aaron, good to hear that there's at least connectivity at this point using the client-bridge. Based on your information, I'm still not sure if the AP has a hardware problem or not, but the fact that it has established a connection while operating as the host AP seems to make that unlikely.
It would be interesting to default things again and re-setup the APs again in their original positions, with the only change being the WiNG code. If it works...then that seems to implicate the WiNG code...but then I'm at a loss because in my lab, using the original same firmware, it worked. The *only* difference being that I used a 7532 and you're using a 7522.

Regarding #3 though:
Win10 apparently thinks there's an IP conflict. Guessing that's the reason it's throwing away its static address.
Need to clear out the ARP cache and try again. I think you're almost there.