topic AP310 won't adopt to VC in ExtremeWireless (WiNG)

AP310 won't adopt to VC

JohanHendrikx — Mon, 08 Aug 2022 11:47:32 GMT

At a remote site I have 9 new AP310.

2 Ap's won't connect to the VC.

AP have an IP-address and the DHCP server send option191.
AP cann't communicate with the gateway so no RF-manager can be found. Cann't ping the default gateway. Other devices (L2) can be reached

In the logging of the AP I see:

Jan 01 01:47:47 2022: %DATAPLANE-4-ARPPOISON: ARP CACHE POISONING: Conflicting snoop entry found :Ethernet Src Mac: 00-04-96-A0-7C-1D, Ethernet Dst Mac: 00-DC-B2-3A-9B-EF, ARP Src Mac: 00-00-5E-00-01-01, ARP Dst Mac: 00-DC-B2-3A-9B-EF, ARP Src IP: 10.2.116.254, ARP Target IP: 10.2.116.1, Snoop Table MAC = 00-04-96-A0-7C-1D, Snoop Table IP = 10.2.116.254
Jan 01 01:47:47 2022: %KERN-4-WARNING: [ 1630.319376]

10.2.116.254 is the L3 router of that netwerk and is a VRRP configuration.

How can I solve this?

Re: AP310 won't adopt to VC

Christoph_S — Mon, 08 Aug 2022 16:13:36 GMT

Hello Johan,

Are we talking about remote adoption by a VX9000 controller or by an AP310 virtual controller? If it's the latter, this is not supported as those are intended for adoption in same broadcast domain over L2.

Please advise.

Thank you,

Re: AP310 won't adopt to VC

JohanHendrikx — Tue, 09 Aug 2022 09:12:42 GMT

Christoph,

The controller is locate at HQ. At the remote site there are AP310. The AP310 isn't a virtual controller.

Re: AP310 won't adopt to VC

Angelo_Cargnel — Tue, 09 Aug 2022 13:17:27 GMT

Hi Johan,

due to VRRP in your network, you have to disable "ip-mac conflict" and "ip-mac routing conflict" in the firewall policy.
This should solve your problem.

Best regards,
Angelo

Re: AP310 won't adopt to VC

JohanHendrikx — Wed, 10 Aug 2022 09:23:56 GMT

Hi @Angelo Cargnel,

Firewall policy wasn't active.

I will change those settings.

At this moment I solved this issue by setting:

%DATAPLANE-4-ARPPOISON: ARP CACHE POISONING: Conflicting snoop entry found:
"IP arp trus"on interface ge 1

and
%DATAPLANE-4-DOSATTACK: IPSPOOF ATTACK: Source IP is Spoofed
in the default firewall policy :
"no ip dos ipspoof

Question remains why 7 other AP's connect without any problem and 2 not.

Re: AP310 won't adopt to VC

Christoph_S — Wed, 10 Aug 2022 15:24:53 GMT

Hello Johan,

If you have not done so yet, please implement the best practices firewall policy per this article: https://extremeportal.force.com/ExtrArticleDetail?an=000078342

All the recommended settings are therein.

BR

Re: AP310 won't adopt to VC

Adam_Minowski — Wed, 31 Aug 2022 22:55:52 GMT

VC functionality requires that all APs, meaning VC and rest of APs (adtoptees) to be in the same VLAN. Layer3 adoption is not supported.