topic Some concepts about VC to be clarify. in ExtremeWireless (WiNG)

Some concepts about VC to be clarify.

zlinuxboy — Mon, 23 Aug 2021 21:47:39 GMT

I have two ap7522(a and b etc) and config dynamic VC on one of them. A was elect as VC, B was adopted to the VC. here is the questions:

will ap A be adopted by VC too?
may I refine the VC config on B and auto update the whole rf domain?
If I ssh into B and set a static ip to it, after a while the ip just disappear.
here is the context of vc:
---
profile ap7522 default-ap7522
ip name-server 221.176.88.95
ip default-gateway 192.168.9.254
autoinstall configuration
autoinstall firmware
crypto ikev1 policy ikev1-default
isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ikev2 policy ikev2-default
isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
crypto ikev1 remote-vpn
crypto ikev2 remote-vpn
crypto auto-ipsec-secure
crypto load-management
crypto remote-vpn-client
interface radio1
wlan wing-hkxd bss 1 primary
interface radio2
wlan wing-hkxd bss 1 primary
interface ge1
switchport mode trunk
switchport trunk allowed vlan 7-10
switchport trunk native vlan 9
interface vlan1
ip address dhcp
ip address zeroconf secondary
ip dhcp client request options all
interface vlan7
description guestUser-vlan
interface vlan8
description homeUser-vlan
interface vlan9
description mgt-vlan
interface vlan10
description device-vlan
interface pppoe1
use firewall-policy default
ntp server 0.pool.ntp.org
use client-identity-group default
virtual-controller auto
virtual-controller management-interface ip address 192.168.9.140/24
virtual-controller management-interface vlan 9
rf-domain-manager capable
logging on
service pm sys-restart
router ospf
adoption-mode controller
---
Any hints? thanks in advanced.

both of them have a mint links to A

ap7522-A2DA54#show mint links
2 mint links on 75.A2.DA.54:
link vlan-7 at level 1, 1 adjacencies, DIS 75.A2.DA.54 (self)
link vlan-9 at level 1, 1 adjacencies, DIS 75.A1.AE.58

why A link to itself through vlan 7, what exactly purpose link itself with mint?

Re: Some concepts about VC to be clarify.

ckelly — Mon, 23 Aug 2021 22:00:04 GMT

1. will ap A be adopted by VC too?

No. If A is the VC, then it will not adopt to another VC.

2. may I refine the VC config on B and auto update the whole rf domain?

Refer to #3. short answer, once an AP is adopted to a VC, you make all changes using the VC (as if it were an actual WiNG controller). Don’t touch the AP configs directly. let the controller or VC do that.

3. If I ssh into B and set a static ip to it, after a while the ip just disappear.

If B is adopted to A(VC), then A is maintaining B’s config. In this way, any changes to an adopted AP should only be performed on the controller/VC device. What is probably happening here is that you make the change on B, but then A(VC) is simply correcting it, since it has what is supposed to be the correct config for B.

Re: Some concepts about VC to be clarify.

zlinuxboy — Mon, 23 Aug 2021 23:08:45 GMT

well the question 1 I mean when A was elected as VC, will A be adopted to A(VC) itself, I know it’s weird question, but I want to know that. 🙂

thanks @Chris Kelly , there is question 4 unanswered yet.

oh, I just find out that when unplug A, B will elect itself as VC, but when A come back, the VC role will migrated from B to A immediately. Any possible to keep B as VC role until it failed, Afterall both A and B are the same type AP7522. Is there any impact on the rf-domain when the VC role migrating between APs?

Re: Some concepts about VC to be clarify.

Christoph_S — Mon, 23 Aug 2021 23:42:09 GMT

To answer your question: AP “A” will not adopt to itself.

Here’s some info on priority election:

Election priority is determined in one of 3 ways:

Lowest Mint-ID (Only If all APs are similar). Nothing needs to be configured in this case
Highest model (For heterogeneous deployments). Nothing needs to be configured in this case.
RF-domain manager priority: This should be configured as an override on each AP in the redundancy pool. This allows you to control which AP is next in line to become the Virtual controller should the current one fail. Still on the AP to be designated as the primary VC go to Configuration >> Devices >> Device Overrides >> Select the AP >> Edit >> Profile Overrides >> General >> RF Domain Manager >> Priority >> Check the box >> Enter 255 >> OK >> Commit and Save.

This AP will become the designated primary virtual controller which should start adopting all other APs.

Once done, configure the priority on the rest of the APs selected to be in the redundancy pool by going to Configuration >> Devices >> Device Overrides >> select AP >> Edit >> Profile Overrides >> RF Domain Manager >> Priority >> Check the box >> Enter 254 >> OK >> Commit and Save. Repeat these steps on all APs in the redundancy pool, decreasing the priority on each accordingly.

In other words, there is no automated way to keep a newly elected AP (after initial AP goes down) as VC if another AP with a lower mint ID was added. You can set rf domain manager priority so that if the AP that goes down is replaced (RMA’d), you can set a lower RFDM priority on the new AP so that the current VC AP is not switched.

I hope this makes sense.

Thank you,

Re: Some concepts about VC to be clarify.

ckelly — Mon, 23 Aug 2021 23:50:17 GMT

Ahh, I see. Answer is still no. When an AP is operating as a VC, it’s as if it’s actually a regular WiNG controllers (with some caveats). So in the same way that a controller doesn’t adopt itself, same for a VC. Although, unlike a regular controller, a VC AP still operates as an AP (has wlans operating on it)

I see that on this AP’s config you have only 1 single wlan mapped to the radios. But, you have created SVIs for 4 VLANs (7-10). Any reason for that? Also, you don’t need to create those SVIs for the wlans. Just create the trunked ge1 interface and specifiy whichever VLANs are used by any mapped wlans. So, whichever VLAN that wlan “wing-hkxd” is using, that is the only VLAN you need to list in the allowed VLANs. Or, if you are planning to add additional wlans (assigned to other VLANs) then also add those VLANs to the allowed list. Or, if you are planning to run DHCP services on the VC for those other VLANs, then you would also need those SVIs.

interface radio1
wlan wing-hkxd bss 1 primary
interface radio2
wlan wing-hkxd bss 1 primary

interface ge1
switchport mode trunk
switchport trunk allowed vlan 7-10
switchport trunk native vlan 9

Missed #4

I’m guessing here that the mint ID 75.A1.AE.58 belongs to the other 7522 that is adopted. The second listing is simply indicating an adjacency using a Layer-2 (“link vlan-7”) level-1 MINT link to that AP. This is happening over VLAN-9 (the native VLAN according to your config).

The other MINT link on vlan-7 is for the AP it(self). You will see this for each type of entry for each WiNG device. Not sure why it’s vlan-7 though. Do you have something entered in the device override section concerning VLANs? (that section wasn’t included in your config posting)

Re: Some concepts about VC to be clarify.

zlinuxboy — Tue, 24 Aug 2021 09:50:05 GMT

@Chris Kelly

well, I would like to seperate clients onto different vlan, such vip on vlan 8, normal on vlan 7 and guest on vlan 10.
Any possible to impement these vlan map within wing? The aerohive's ppsk user group could do this elegent.

Re: Some concepts about VC to be clarify.

ckelly — Tue, 24 Aug 2021 20:41:20 GMT

This could be done using different SSIDs or you could use dynamic VLAN assignment. With that, each user’s RADIUS authentication could provide a return attribute (tunnel-private-group-id) that WING would use to place them onto the specified VLAN.

Role based vlan assignment could also be used (based on supported attributes from LDAP/AD) or simply based on assigned user roles that are based on things like AP location, auth/encryption type, group membership, MAC, SSID.

Re: Some concepts about VC to be clarify.

zlinuxboy — Mon, 30 Aug 2021 21:02:39 GMT

If the ethernet port to ap is set to access, any possible to dynamic assign different vlans to different group users?

Re: Some concepts about VC to be clarify.

zlinuxboy — Tue, 31 Aug 2021 17:00:59 GMT

@Chris Kelly

Is there any articles or white paper about MiNT protocol introduce work flow and more detail infomation. because I think MiNT is the spirit of WiNG, so I wan to learn it more.

I have some question about MiNT when deployment. the only article about MiNT on web is :

Motorola MiNT Protocol What is It

but I don’t have the access to it.

Re: Some concepts about VC to be clarify.

Tomasz — Fri, 10 Sep 2021 02:34:53 GMT

Hi,

I think the how to guides (for centralized deployment or for best practices) explain a bit about MINT. Good to know, it’s based on IS-IS. What would you like to know certainly? We can try to provide you with more details on the fly hopefully.

Kind regards,

Tomasz