topic Re: Hello! How does tunneling within aerohive work? I want to tunnel our "guest-VLAN" (which is in our DMZ) to another location which has no internet breakout. in Aerohive Migrated Content

Hello! How does tunneling within aerohive work? I want to tunnel our "guest-VLAN" (which is in our DMZ) to another location which has no internet breakout.

AnonymousM — Wed, 04 Jul 2018 14:54:08 GMT

Hello! How does tunneling within aerohive work? I want to tunnel our "guest-VLAN" (which is in our DMZ) to another location which has no internet breakout.

Re: Hello! How does tunneling within aerohive work? I want to tunnel our "guest-VLAN" (which is in our DMZ) to another location which has no internet breakout.

AnonymousM — Wed, 04 Jul 2018 14:54:39 GMT

Thanks for any help! 🙂

Re: Hello! How does tunneling within aerohive work? I want to tunnel our "guest-VLAN" (which is in our DMZ) to another location which has no internet breakout.

AnonymousM — Wed, 04 Jul 2018 15:26:43 GMT

And we are using 330s and 250 at our main facility, 250 and 1130s at the other facilities.

Re: Hello! How does tunneling within aerohive work? I want to tunnel our "guest-VLAN" (which is in our DMZ) to another location which has no internet breakout.

dsouri — Fri, 06 Jul 2018 02:22:46 GMT

Hi Florian,

Please see this article on NAT DHCP:

https://thehivecommunity.aerohive.com/s/article/NAT-DHCP

Let me know if I can help,

Happy to assist,

David Souri

HiveCommunity Moderator

Re: Hello! How does tunneling within aerohive work? I want to tunnel our "guest-VLAN" (which is in our DMZ) to another location which has no internet breakout.

bruce_stahlin — Fri, 06 Jul 2018 03:50:59 GMT

You will perform Identity-based traffic tunneling between devices in the same network policy. Here are the basic steps:

Create a user profile; http://docs.aerohive.com/330000/docs/help/english/ng/Content/gui/configuration/viewing-user-profile-list.htm
Click the Traffic Tunneling tab
Toggle the Traffic Tunneling (GRE) switch to On and select Identity-Based Traffic Tunneling
Select the Tunnel Source, Destination, and the Authentication.

If you need greater detail, let me know which version of HM you're running & whether it's cloud or on-prem.

Best,

Re: Hello! How does tunneling within aerohive work? I want to tunnel our "guest-VLAN" (which is in our DMZ) to another location which has no internet breakout.

AnonymousM — Fri, 06 Jul 2018 14:07:05 GMT

Hello!

Thanks for your answers.

I think i have to explain more of my "Setup". So we have Network policies for each of our locations and our internetbreakout out is at our main Location. In the DMZ of our main Location we have created our guest-vlan which is used for our guest-wlan only. Now we want to establish a tunnel between the main Location and other Locations to use our guest-wlan at other locations too.

I read about the possibility of aerohive doing this, but can't seem to find where and how.

Thanks for your answers.

Re: Hello! How does tunneling within aerohive work? I want to tunnel our "guest-VLAN" (which is in our DMZ) to another location which has no internet breakout.

bruce_stahlin — Fri, 06 Jul 2018 15:24:54 GMT

Understood, please send HM version for more specific details.

Re: Hello! How does tunneling within aerohive work? I want to tunnel our "guest-VLAN" (which is in our DMZ) to another location which has no internet breakout.

AnonymousM — Fri, 06 Jul 2018 16:35:41 GMT

8.2r1

Re: Hello! How does tunneling within aerohive work? I want to tunnel our "guest-VLAN" (which is in our DMZ) to another location which has no internet breakout.

bruce_stahlin — Sat, 07 Jul 2018 02:07:06 GMT

I did this in Classic quite a while ago. Some things may have changed, but here is how we configured the tunneling:

Assign static IP addressing on the APs that will be performing the tunneling.
Make sure all participating APs are using the same Network Policy
Setup a guest SSID
Setup authentication
Create a User Profile;
1. Assign the VLAN (we matched the DMZ VLAN);
2. Under "Optional Settings," drop "GRE Tunnels" menu and select "GRE tunnel for roaming or station isolation" and create a tunnel policy
  1. Name the Tunnel Policy
  2. Under "Tunnel Settings" select "Enable Static Identity-Based Tunnels" and
  3. Under "Tunnel Destination" enter the IP address of the AP that has access to the DMZ
  4. Under "Tunnel Source IPs or Subnets," Select the IP addresses of the APs in your remote facilities
  5. Generate a password under "Tunnel Authentication"

This will create the tunnels between the APs. You may still encounter issues when connecting, , e.g. DHCP, particularly if any firewalling is being performed. Additionally, you may want to place a firewall policy on the remote APs to prevent the DMZ addresses from accessing your private LANs int the remote facilities.

Let me know if you run into any issues.

Best,