topic RE: I can't seem to make 3rd Party AP work. in ExtremeWireless (Identifi)

I can't seem to make 3rd Party AP work.

Rahman_Duran1 — Fri, 26 Jun 2015 18:07:00 GMT

Hi,

We have 15 aruba IAP devices which I want to use them as 3. party AP on C5210 controller to utilize internal captive portal.

I hook up the esa1 port to the swich and set the vlan tagging. Then I created a wlan on aruba and set it to vlan 60 tagged. Configured all the switches to pass vlan 60 so it can reach controller. I also created a dhcp pool on our dhcp server and configured it so vlan 60 clients use EWC interface ip (10.100.60.2) as their gateway.

So, I tried to connect to aruba but I can't seem to get ip address and connect to wlan. So what is wrong with my setup? Any hint on this is mostly wellcome.

Thanks,

Rahman

RE: I can't seem to make 3rd Party AP work.

Andre_Brits_Kan — Fri, 26 Jun 2015 18:49:00 GMT

Hi Rahman

I would suggest that you configure a "untagged" port (Access port) in vlan 60 first and connect a laptop to this port to see if you receive a IP address.

If you do not receive a IP address, provision your laptop with a static IP in the 10.100.60.x range and see if you can ping the IP interface on the controller.

The problem might be with your DHCP server, or with the vlan not being tagged in your network infrastructure.

One thing to note is that the 3rd Party interface acts like a router, so for your DHCP server to be able to reach this subnet you will need to add some route to get to the 10.100.60.x network, route to the wireless controller.

RE: I can't seem to make 3rd Party AP work.

Ronald_Dvorak — Fri, 26 Jun 2015 18:51:00 GMT

Try it first with no authentication to check whether you get an IP.

Does the DHCP server knows the route back to the 10.100.60.x network.
Go in > Controller > Network > Utlities > put in the IP of the DHCP , checkmark "use specific source interface" and select the esa1 interface to check whether you'd ping from the controller ESA1 to the DHCP.
BTW, why are the APs in network 172.16.64.x and not 10.100.60.x ?

-Ron

RE: I can't seem to make 3rd Party AP work.

Rahman_Duran1 — Fri, 26 Jun 2015 18:54:00 GMT

Hi Andre,

I will try your suggestions. But let me ask about routing. When I set dhcp relay, EWC will relay package via its esa1 interface or via other interface which default route is set (esa0)?

RE: I can't seem to make 3rd Party AP work.

Ronald_Dvorak — Fri, 26 Jun 2015 18:58:00 GMT

With DHCP relay the controller will "collect" the DHCP broadcast packets on ESA1 and forward it to the DHCP IP as a unicast - he'll lookup his routing table to get to this IP.
So if there is no entry for the DHCP server network in your static routing table the default gateway route is used.

The issue is the return packet - the DHCP is sending the packet back to 10.100.60.x using his own routing table (default gateway) but if you don't have a route to this network on your i.e. core switch the packet will be dropped.

RE: I can't seem to make 3rd Party AP work.

Andre_Brits_Kan — Fri, 26 Jun 2015 19:01:00 GMT

What Ronald said 

RE: I can't seem to make 3rd Party AP work.

Rahman_Duran1 — Fri, 26 Jun 2015 19:02:00 GMT

Ronald,

EWC's default routing interface is on esa0 (192.168.10.122). So I need to write a static route like this; 10.100.60.0/24 192.168.10.122 ?

>BTW, why are the APs in network 172.16.64.x and not 10.100.60.x ?

Because these aruba devices also broadcast eduroam(802.1x) WLAN and it is on 172.xxx.xxx.xxx subnet. CP WLAN is tagged as vlan 60 so it is a seperate network even the ap's management network subnet is different.

RE: I can't seem to make 3rd Party AP work.

Ronald_Dvorak — Fri, 26 Jun 2015 19:02:00 GMT

Correct, you add the route to the router in the 192.168.10.x network and then you should be able to ping from the DHCP server to 10.100.60.2 and vice versa.

RE: I can't seem to make 3rd Party AP work.

Jason1 — Fri, 26 Jun 2015 19:25:00 GMT

Rahman,

This article should help with getting the captive portal to work with the 3rd party AP's. There needs to be a change to allow out-of-network traffic to bypass that rule.

https://gtacknowledge.extremenetworks.com/articles/Solution/IdentiFi-3rd-Party-VNS-not-working-with-...

Thanks,
Jason

RE: I can't seem to make 3rd Party AP work.

Rahman_Duran1 — Mon, 29 Jun 2015 18:07:00 GMT

So after trying lots of thing I can't even ping EWC 3. party interface ip. I changed topology to vlan 60 untagged. Then get a laptop, gave it 10.100.60.100/24 and plugged it directly to esa1. But I could not ping esa1 ip (10.100.60.2). I plugged laptor to the same switch with esa1, in a port of vlan 60 untagged, can't ping 10.100.60.2 either.

If any of you has a working setup, can you share screenshots of
Virtual Networks
WLAN Services
Roles
Topologies sections of 3rd party service?

Thanks,

Rahman

RE: I can't seem to make 3rd Party AP work.

Rahman_Duran1 — Mon, 29 Jun 2015 18:38:00 GMT

Also Do I need to create complete set of "Virtual Networks", "Auth/nonAuth roles" etc? Or I just create a 3rd party phisical interface and create 3rd party WLAN service? BTW how does EWC use 3rd party ip IPs and mac addresses? CP clients will use EWC ip as gateways so our Aruba AP's ip or mac address won't reach to EWC.

RE: I can't seem to make 3rd Party AP work.

Jason1 — Mon, 29 Jun 2015 23:21:00 GMT

Hello Rahman,

You will want to create a Virtual Network Service (VNS), Role and WLAN service in addition to the physical 3rd Party Topology.
I created the Topology, then Role, then the WLAN Service and then the VNS.
Map the VNS to the WLAN Service and Role to allow traffic.

I have this working with a similar setup as your VLAN 60, with a local DHCP server.

In my setup I have a mgmt IP of 120.120.120.179/16 on esa0 (Port1) and the 3rd Party AP Topology is 20.20.20.1/24 on esa2 (Port3). As you and Ron discussed, I have a route set up to get back to the topology: 20.20.20.0/24 120.120.120.179
The Role is configured as a Contain to VLAN (for use with a Captive Portal). Make sure that the AP Filter box in the Policy Rules tab is unchecked, since we are filtering at the EWC.
Once that is set up, you will see any clients that get an IP in the Active Clients by VNS.
You shouldn't need the IP address of the AP, the mac address can be added by itself, as you will see in the screen shots that follow.

Regards,
Jason

RE: I can't seem to make 3rd Party AP work.

Rahman_Duran1 — Wed, 01 Jul 2015 15:28:00 GMT

Thank you Jason, but I can't make it work. Can you also share pre-authenticated role?

I setup every thing as shown here except I used same role for pre-auth role.

Here is how topology filter page looks:

I plug my laptop to the switch with vlan 60. I can't get ip address. I configured static ip 10.100.60.100 on laptop with gateway 10.100.60.2 but I can't even ping 10.100.60.2. I can ping 10.100.60.2 from different subnets so routing seems to work. Even wierd I can see my laptop and switch port mac addresses on clients reports:

Also there is something really wrong here. When I make changes on 3rd party vns setting and save it, all the other vns clients lose connection. When they scan wifi all ssid show up and disappear continuously and new users can't connect. There is no log about any error on EWC. Only rebooting EWC solves this situation.

So I fear to make any furter changes as it affects all users.

RE: I can't seem to make 3rd Party AP work.

Ronald_Dvorak — Wed, 01 Jul 2015 15:45:00 GMT

Could you please post the role configuration.....

RE: I can't seem to make 3rd Party AP work.

Ronald_Dvorak — Wed, 01 Jul 2015 15:50:00 GMT

... and also the client report but this time please include the "default action" column.

RE: I can't seem to make 3rd Party AP work.

Rahman_Duran1 — Wed, 01 Jul 2015 15:56:00 GMT

It is the same as what Jason posted. Here all the screenshots

RE: I can't seem to make 3rd Party AP work.

Rahman_Duran1 — Wed, 01 Jul 2015 16:01:00 GMT

here clients with more columns:

RE: I can't seem to make 3rd Party AP work.

Jason1 — Wed, 01 Jul 2015 19:40:00 GMT

Rahman,

I don't think you can ping the 10.100.60.2 address because your clients are not authenticated. On my client report, there is a "green lock" denoting authentication. (Similar to the Apple device on eduroam with the 172.x.xx. address) On your list, I see the clients have a grey "unlocked" icon.

Can you disable authentication temporarily to test?

For an Internal Captive Portal deployment, you will want a Non-Auth Role (similar to the screen shot below, referenced in the knowledgebase link in my original post)

Regards,
Jason

RE: I can't seem to make 3rd Party AP work.

Rahman_Duran1 — Wed, 01 Jul 2015 21:09:00 GMT

Thank you Jason for your helps. This seems the missing bit in my config. I will try it and inform you if it works.

Btw, any idea why ewc misbehave and need a reboot as I described?

RE: I can't seem to make 3rd Party AP work.

Jason1 — Thu, 02 Jul 2015 01:33:00 GMT

Rahman,

Yes, let me know if that works for you. I have a basic set up on a 4110 with no authentication working (with a client directly connected or connected with a VLAN 20 port) .

I suspect the reason for the EWC misbehaving is some type of forwarding path issue where the reboot clears that until another config change?
Also, is it possible that your VLAN 60 has another route back to the 10.100.x.x network that is on the switch side, and not through the 192.x.x.x esa0 port?
I would recommending deleting and re-configuring from the beginning if possible. If not, then we can take a deeper dive into the configuration if need be. I have not seen that behavior in my lab scenario.

Regards,
Jason