topic Re: different Vlan configuration in ExtremeWireless (WiNG)

different Vlan configuration

Malik — Thu, 14 Oct 2021 11:57:19 GMT

how can configure different VLANs for Access Points and WLANs for clients ??

Re: different Vlan configuration

rmu — Thu, 14 Oct 2021 12:06:51 GMT

hi malik

do you need a vlan for ap management and separate vlans for ssid traffic?
do you have a static mapping ssid<>vlan or should this be dynamic?
do you use one ssid where different client traffic should use different vlans?
do you have one ssid in several locations, but the breakout vlan is different by location?

can you pls explain the requirement in more detail?

Re: different Vlan configuration

ckelly — Thu, 14 Oct 2021 15:22:11 GMT

Malik, in the simplest form, you assign a static VLAN to a wlan profile (make ge1 a trunk and add that VLAN to the allowed VLAN list in the ge1 config). Then when clients associate to that wlan, they are mapped to that VLAN.
Beyond that, there are more ways to set this up depending on how you need it to work.

Re: different Vlan configuration

Karol_Radosovsk — Thu, 14 Oct 2021 16:02:21 GMT

If you are new to WING, I strongly recommend read through the "How to" materials, which were created some time ago, but they are still mostly relevant, as Extreme & Zebra didn't add anything revolutionary to the whole system.
This is, where it's currently stored:
https://www.extremenetworks.com/support/documentation/wing-5-x-how-to-guides/
I "must read" would be this document: "Best practices and Recommendations".
https://documentation.extremenetworks.com/WiNG/Implementation_Guides/WING5X_Reference_Best_Practices_and_Recommendations_Rebranded-Final.pdf
I also recommend to have both GUI and CLI reference guides "on hand". Extreme is somewhat late with versions, but the most of if doesn't change significantly anyway. Here's for 5.9.7 version: https://www.extremenetworks.com/support/documentation/extremewireless-wing-software-5-9-7/

Re: different Vlan configuration

Malik — Sun, 17 Oct 2021 09:32:20 GMT

many thanks @rmu please find the below answer :

do you need a vlan for ap management and separate vlans for ssid traffic? yes exactly, I need vlan for management and other vlan for ssid traffic
do you have a static mapping ssid<>vlan or should this be dynamic? by dynamic

already I have vlan for management and ssid so When clients connect to the SSID, they get an IP address from the same vlan
So I want clients to have an IP ,but from another VLAN.

Re: different Vlan configuration

ckelly — Mon, 18 Oct 2021 15:18:22 GMT

Malik, to configure a VLAN for an SSID, see this article.

For configuring the port, see this thread.

Re: different Vlan configuration

Christoph_S — Mon, 18 Oct 2021 15:21:05 GMT

Hello Malik,

if you already have the vlans configured on you network (switch) you'll have to do the following in the AP profile:

Note: Make sure that all vlans are allowed through the switchports the APs are connected to

Create native vlan if other than vlan 1
Map the vlans to the WLANs
Trunk the ge 1 port and allow all vlans through

1 - Create Native vlan if other than vlan 1.

#config
#profile <ap model> <profile name>
#int vlan1
#no ip dhcp client request options all
#interface vlan<new native vlan ID>
#IP address DHCP
#ip address zeroconf secondary (only if you'd like to be able to access the APs via the APIPA zeroconfig address)
#ip dhcp client request options all
#com wr
#..

2 - Trunk the ge 1 port (still in AP profile):

#int ge 1
#switchport mode trunk
#switchport trunk allowed vlan <vlan IDs> (The List of the VLAN IDs and aliases e.g. 10-20,25,30-35,$GUEST)
#switchport trunk native vlan <native vlan ID>
# com wr

Article on same: https://extremeportal.force.com/ExtrArticleDetail?an=000080209

3 - Map vlans to wlans:

#config
#wlan <wlan name>
#vlan <vlan id>
#com wr

I hope this helps,

Christoph

Re: different Vlan configuration

Malik — Thu, 28 Oct 2021 13:30:43 GMT

Hello Christoph S. , many thanks for your answers .

I set vlans to WLAN and made ge port 1 trunk and allow all vlans to pass through but when clintes connect to the Wlan thier get an APIPA ip address.

Re: different Vlan configuration

Christoph_S — Thu, 28 Oct 2021 15:47:30 GMT

Hello Malik,

1 - Plug your laptop into the same switchport the AP was plugged into and configure it for the same vlan. Does it pull and IP address?
2 - Configure your laptop with a static IP address for said VLAN and connect to the wlan. Can you ping anything on said vlan, namely the DGW, DHCP server, other devices.
3 - Make sure that the switch the APs are connected to are also trunked allowing same vlans through

On the AP you can run the following command to see where DORA is failing:

#service pktcap on interface ge1 count 100 filter port 67
Try to connect your wireless device at this point and check the output.

I hope this helps

Re: different Vlan configuration

rmu — Mon, 08 Nov 2021 15:37:14 GMT

hi malik

when clients get an AP-IP, i think your ssid is mapped to the same vlan.

heres an excerpt of my lab-config:

wlan LAB-Notebooks
description LAB-Notebooks
ssid lab-notebooks
vlan 100
bridging-mode local
encryption-type ccmp
authentication-type none
wpa-wpa2 psk 0 <passphrase>
wpa-wpa2 tkip-countermeasures hold-time 3600

wlan LAB-Tablets
description LAB-Tablets
ssid lab-tablets
vlan 200
bridging-mode local
encryption-type ccmp
authentication-type none
wpa-wpa2 psk 0 <passphrase>
wpa-wpa2 tkip-countermeasures hold-time 3600

profile ap410 lab-ap410
interface radio1
wlan lab-notebooks bss 1 primary
wlan lab-tablets bss 2 primary
interface radio2
wlan lab-notebooks bss 1 primary
wlan lab-tablets bss 2 primary
interface ge1
switchport mode trunk
switchport trunk allowed vlan 10,100,200
switchport trunk native vlan 10
interface vlan10
description AP-Mgmt
ip address dhcp
ip dhcp client request options all

>> ap is using vlan 10 for management. ap interface is untagged for vlan 10.
>> both ssids are bridged locally at the ap
>> ssid: lab-notebooks >> vlan 100
>> sisd: lab-tablets >> vlan 200

if it still does not work in your setup, pls send me your config.

Re: different Vlan configuration

Malik — Thu, 11 Nov 2021 14:26:38 GMT

Hi

thanks for all replay

I did it but in a different way, so I have configured bridging mode in WLAN to Tunnle mode with vlan 1725 assignment, after that clients get IP from this vlan (1725) and everything's it's ok,

but the new issue appeared, which is the connectivity is unstable because I have two controller with cluster configuration ( Active ,standby ) ,but when turn off one of the two controllers the the connection becomes stable.

Re: different Vlan configuration

rmu — Thu, 11 Nov 2021 17:38:46 GMT

hi malik

can you send the config?

nr
rmu

Re: different Vlan configuration

Malik — Sun, 14 Nov 2021 13:58:13 GMT

thanks rmu

kindly find the attached configuration file for NX-5500 controller.

Re: different Vlan configuration

rmu — Mon, 15 Nov 2021 00:34:13 GMT

hi malik

do you also have a little network diagram?

nr
rmu

Re: different Vlan configuration

rmu — Mon, 15 Nov 2021 02:57:15 GMT

hi malik

there are a few things:

both nx controllers use the same profile but still have
different configurations.

> it looks like you configured both controllers seperately
> best practice would be: configure everything in profiles except unique settings like hostnames,
ip adresses, priorities and such things

Karol Radosovsky already posted the link with the best practice guide

e.g.

> master has layer 2 adoption enabled, while stby has mlcp vlan disabled
> master has vlan 102 configured and ge3 in it, stby does not even have it

> both controllers use vlan 1 with the same ip! on interface ge1/vlan1
>> maybe thats the cause of your instability.

> stby controller does not use dhcp-server-policy
> stby controller does not use auto-provisioning-policy

> dhcp-server-policy: you only send the ip of the master controller, stby controller ip is missing

## and some more settings

so, can you pls send over a little network diagram, how you plan to set up your wlan?

nr
rmu

Re: different Vlan configuration

Malik — Mon, 15 Nov 2021 16:21:43 GMT

thanks rmu
kindly find the above network diagram,

so all devices are connecting together by core switch and all devices in vlans have an ips from an External DHCP server so
ths APs connected to the ERS Access switch on port (eth 1 - 9 ) Which belong to vlan 1089 kindly find the below configuration on ERS 3600 SW :

3626GTS-PWR+#sh running-config
! Embedded ASCII Configuration Generator Script
! Model = Ethernet Routing Switch 3626GTS-PWR+
! Software version = v6.1.1.017
!
! Displaying only parameters different to default
!================================================
enable
configure terminal
!
! *** CORE ***
!
telnet-access login-timeout 0
!
! *** RADIUS ***
!
!
! *** RADIUS Dynamic Server ***
!
!
! *** TACACS+ ***
!
!
! *** SNMP ***
!
!
! *** IP ***
!
ip default-gateway 10.234.88.2
!
! *** IP Manager ***
!
!
! *** ASSET ID ***
!
!
! *** System Logging ***
!
!
! *** STACK ***
!
!
! *** Custom Banner ***
!
!
! *** SSH ***
!
ssh
!
! *** SSL ***
!
!
! *** SSHC ***
!
!
! *** MSTP (Phase 1) ***
!
!
! *** LACP (Phase 1) ***
!
!LACP mode is set to OFF on all interfaces to enable manipulation of
!ports with LACP enabled
interface Ethernet ALL
lacp mode port ALL off
exit
!
! *** VLAN ***
!
vlan create 1088-1092, type port cist
vlan name 1088 "mgmt"
vlan name 1089 "Wirleses"
vlan name 1090 "voice"
vlan name 1091 "Peripherals"
vlan name 1092 "Supervisors"
vlan ports 24-25 tagging tagAll
vlan configcontrol flexible
vlan members 1 13-14,17-21,24-25,27-28
vlan members 1088 15,25
vlan members 1089 1-12,25
vlan members 1090-1091,1725 25
vlan members 1092 16,22-23,25
vlan ports 1-12 pvid 1089
vlan ports 15 pvid 1088
vlan ports 16,22-23 pvid 1092
vlan configcontrol strict
!
! *** 802.1ab ***
!
!
! *** 802.1ab vendor-specific TLVs config ***
!
interface Ethernet ALL
! no lldp tx-tlv port 1-10 vendor-specific fa-element-type ==> controlled by FA
agent
! no lldp tx-tlv port 1-10 vendor-specific fa-isid-vlan-asgns ==> controlled by
FA agent
exit
!
! *** 802.1AB MED Voice Network Policies ***
!
!
! *** QOS ***
!
!
! *** RMON ***
!
!
! *** EAP ***
!
!
! *** EAP Guest VLAN ***
!
!
! *** EAP Fail Open VLAN ***
!
!
! *** EAP Voip VLAN ***
!
!
! *** Interface ***
!
!
! *** Rate-Limit ***
!
!
! *** MLT (Phase 1) ***
!
!
! *** MAC-Based Security ***
!
!
! *** LACP (Phase 2) ***
!
!
! *** ADAC ***
!
!
! *** MSTP (Phase 2) ***
!
interface Ethernet ALL
spanning-tree mstp port ALL learning disable
exit
!
! *** Port Mirroring ***
!
!
! *** VLAN Phase 2***
!
!
! *** MLT (Phase 2) ***
!
!
! *** PoE ***
!
!
! *** RTC ***
!
!
! *** Extreme Networks Energy Saver ***
!
!
! *** AUR ***
!
!
! *** AAUR ***
!
!
! *** L3 ***
!
interface vlan 1088
ip address 10.234.88.4 255.255.255.0 2
exit
ip route 0.0.0.0 0.0.0.0 10.234.88.2 10
!
ip routing
!
!
! *** IPV6 ***
!
!
! *** MLD ***
!
!
! *** FHS ***
!
!
! --- FHS Global settings ---
!
!
! --- IPV6 access list settings ---
!
!
! --- IPv6 mac access list settings ---
!
!
! --- IPV6 dhcp guard settings ---
!
!
! --- IPV6 RA Guard settings ---
!
!
! --- IPV6 Policy Port Map settings ---
!
!
! --- IPV6 FHS ND SBT Table settings ---
!
!
! --- IPV6 Source Guard Interface settings ---
!
!
! *** VLACP ***
!
!
! *** DHCP Relay ***
!
!
! *** L3 Protocols ***
!
!
! --- IP Directed Broadcast ---
!
!
! --- Proxy ARP ---
!
!
! --- UDP Broadcast Forwarding ---
!
!
! --- Route Policies ---
!
!
! --- RIP ---
!
!
! *** DHCP SNOOPING ***
!
ip dhcp-snooping vlan 1089
!
! *** ARP INSPECTION ***
!
!
! *** IP SOURCE GUARD ***
!
!
! *** IGMP ***
!
interface vlan 1
ip igmp
exit
interface vlan 1088
ip igmp
exit
interface vlan 1089
ip igmp
exit
interface vlan 1090
ip igmp
exit
interface vlan 1091
ip igmp
exit
interface vlan 1092
ip igmp

!
! *** STACK MONITOR ***
!
!
! *** SLPP-guard ***
!
!
! *** DHCP Server ***
!
!
! *** SLAMON ***
!
!
! *** STORM CONTROL ***
!
!
! *** Fabric Attach ***
!
no fa port-enable 1-10

and each access point has an own profile that gets from controller to adopt on the two cluster controller with following parameter in each profile :

profile anyap
no mint mlcp vlan
no autoinstall configuration
no autoinstall firmware
crypto ikev1 policy ikev1-default
isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ikev2 policy ikev2-default
isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
crypto ikev1 remote-vpn
crypto ikev2 remote-vpn
crypto auto-ipsec-secure
crypto load-management
crypto remote-vpn-client
interface radio1
wlan Mutah-Wifi bss 1 primary
interface radio2
wlan Mutah-Wifi bss 1 primary
interface radio3
interface bluetooth1
shutdown
mode le-sensor
interface up1
interface ge1
interface ge2
interface fe1
interface fe2
interface fe3
interface fe4
interface vlan1
ip address dhcp
ip dhcp client request options all
interface wwan1
interface pppoe1
use firewall-policy default
controller host 172.25.0.5 pool 1 level 1
controller host 172.25.0.6 pool 1 level 1
service pm sys-restart
router ospf
adoption-mode controller
!

We need to make clients take ip addresses from vlan 1725, so when configuring bridge tunnel mode in wlan config, clientes get ip from vlan 1725 but the loop and unstable connection were accured, and when turn off one of the controllers the connection become stable.