topic Why do I have wired client connected to my Hivemanager ? in Aerohive Migrated Content

Why do I have wired client connected to my Hivemanager ?

thomas_berthome — Tue, 16 Jul 2019 20:09:14 GMT

Hello all,

I have deployed some AP-250 for testing, and it worked well until I have seen a lot of wired client connected to my hivemanager.

I don't understand why the wired client are connecting to the Hivemanager ... Only Wireless user should be able to connect to it.

Currently, we have :

A MGMT vlan for AP management
A User Vlan (for Wired and Wifi client)

I think it could be related to the User'mix on User Vlan.

The best practice should be to separate the two client type, but during a test with another company location, we didn't face this situation.

The main issue is that I want to deploy another subnets for another SSID and my Company IP scope is not as large as I thought.

Do you know if an option exist to avoid wired client ?

Re: Why do I have wired client connected to my Hivemanager ?

samantha_lynn — Thu, 18 Jul 2019 00:51:22 GMT

Typically we see wired clients when there is an Aerohive switch in the network topology, do you have any Aerohive switches? If not, it's likely an issue with AMRP.

Re: Why do I have wired client connected to my Hivemanager ?

thomas_berthome — Thu, 25 Jul 2019 19:36:28 GMT

Hello Sam,

We don't have Aerohive switch. I've check the AMRP and we could have an issue with the Data plane & Mgmt plane.

Currently :

We have a User Vlan (currently use for wired client and wireless client with our last solution). The AP was set on this VLAN : of course it's not good, but it was like when I arrived.

I've made couple test :

AP on the same Vlan than the users => Nok, still wired client on the HIVE
AP on the same Vlan wired user but a separate VLAN for wireless users => Nok, still wired client on the HIVE
I've decided to create a MGMT Vlan (220) dedicated for AP management, and allowed the User Vlan (100) on the Interface. The interface on AP is a trunk and the 2 vlan are tagged on the Switch Interface. Even like that, I had wired clients on my Hivemanager... (see wired_client-AP) => Nok, still wired client on the HIVE
Then, I have decided to put the Wireless client on a separate VLAN (222) [and the AP on the MGMT Vlan], and I don't face this behavior anymore.

I still don't understand why Wired client are on the Hivemanager when I deploy a Wireless AP even when I have the AP on a dedicated Management VLAN. It's not logical.

Re: Why do I have wired client connected to my Hivemanager ?

samantha_lynn — Thu, 25 Jul 2019 19:48:42 GMT

Thank you for explaining your tests, I'm not sure why you are seeing the wired client either. I would recommend opening a technical support case so our engineers can investigate that with you further.

Re: Why do I have wired client connected to my Hivemanager ?

thomas_berthome — Fri, 26 Jul 2019 14:17:00 GMT

Hello,

I've already created a ticket regarding several issue (captive portal [you have answer on it] and this one).

When I did a VLAN Probe on the AP, I've learned the User Vlan subnet on 2 Vlan (which is not normal). Nethertheless, when I tried the product couple months ago, I didn't face this issue (the infrastructure didn't change). It was on On-premises Hivemanager and not cloud.

Re: Why do I have wired client connected to my Hivemanager ?

thomas_berthome — Fri, 09 Aug 2019 16:15:29 GMT

Hello again,

So all my Wifi network are known on my company (until the RADIUS server,etc.). I have one more issue regarding this.

First, I still see my Gateway which is my router on my Management Vlan and the Access Switch (see the picture joined). Still don’t know why.

Gateway on switch :

Secondly, I have well deployed my Policy on my AP but User on my Wifi Vlan can't obtain any IP address (see the picture joined).

To my opinion, the configuration is good on the AP (VLAN mapped with my User Profile associated on the good SSID).

The error I get on client monitor is that the DHCP server is not reachable. So, I suspected a wrong Wired Implementation not related to Wifi AP.

User non IP :

DHCP error :

The vlan is well created end-to-end, from the router to the Access switch (Interconnexion to the AP port). The Gateway is good and reachable from everywhere.

The port where the AP is connected is trunked and all the VLAN are propagated on it (200,210 and 220).

The switch interface (for ETH0 AP) has the VLAN 200 as native vlan and all the VLAN (200,210 and 220) are tagged on the interface.

#############################################

FRARC_SW_06_001(su)->show vlan portinfo port fe.4.21

Port VLAN Ingress Egress

Filter Vlan

-----------------------------------------------------------------

fe.4.21 200 N tagged: 9,200,210,220,222

#############################################

On this configuration, I tried with my own computer and I don't receive any IP from DHCP server. The helper-address/dhcp relay are well configured on router ( when I've plug a computer on interface with VLAN 210 or 220 as native VLAN, no issue with IP so the DHCP server is well configured). So, it's more a switch configuration issue.

What is the correct implementation for aerohive AP ?

Re: Why do I have wired client connected to my Hivemanager ?

thomas_berthome — Fri, 09 Aug 2019 16:22:25 GMT

"What is the correct implementation for aerohive AP ?"

I mean, more the interface switch configuration.

Re: Why do I have wired client connected to my Hivemanager ?

samantha_lynn — Fri, 09 Aug 2019 19:33:12 GMT

Thank you for the detailed question. Since you've ruled out an issue with the VLANs (the AP should be connected to a trunk port when using more than one VLAN, which it sounds like you've confirmed already), I'd like to get a packet capture so we can see the DHCP handshake and which step is failing. To do this, we'll want to follow these steps:

Run a remote sniffer packet capture. This guide reviews how to do this: https://thehivecommunity.aerohive.com/s/article/Packet-Capture-in-NG
While the packet capture is running, replicate the issue with a test device that is unable to get an IP address.
Note the MAC address of the client you are using to replicate the issue, we'll need this later.
Send the packet capture and the MAC address of the test client to communityhelp@aerohive.com.

Once we can see which DHCP packets are failing, that will narrow down where the issue is originating.

Re: Why do I have wired client connected to my Hivemanager ?

thomas_berthome — Fri, 15 Nov 2019 17:27:14 GMT

Hello,

I've finally found my issue on the AP. As I've already worked on Cisco controller managed device, I've set up the same configuration to Aerohive AP.

For Controller managed AP, the port for controller was a Trunk port and the port on AP was an Uplink port. Since the AP was controllerless, I thought I will need a Trunk Port on AP.

Since I have made the change, no problem with connectivity on different VLAN.

Too bad we can't find deployement guide to avoid this situation...