Same policy, different rules how do I manage

[Anonymous]

Hi,

Scenario is that I have 2 x EWC’s. Each of these are in different locations.

Each location has its own internet connection for bridge@ewc for guest internet traffic.

DHCP is being provided by EWC. One large scope has been created and split between each of the controllers.

The issue is the VLAN ID is different in each location. That means the contain to VLAN is different for the same roles on each controller.

The ‘sync’ on the EWC has been removed for those roles between each of the controller because the VLAN ID’s are different. 

The problem is this is creating an issue with policy because you have the same policy with different configuration on each controller, so the policy verification is failing and I can’t get EWC and Policy to sync with that configuration.

Only solution I can think of is change the VLAN ID on both sides to match.

Just wondering if anyone had a better idea, save the trouble I could have in getting the VLAN changed.

Many thanks in advance.

[Miguel-Angel_RO]

Hi Martin,

Why do we all use the VLAN 666 for Internet ? 

Is the authentication done via the NAC?

Could you share the screenshots concerning the config and the authentication of the captive portal?

What is the role and the VLANID/DHCP subnet at the second location?

Mig

[Anonymous]

Thanks all for posting a reply.

Hi Mig, thanks also. Will aim to answer your questions. Apologies, was trying keep it simple but get your point. 

What I  was trying to achieve predominantly was to clear the error I was getting with policy verification on XMC.

This was due to the fact the synchronisation was broken between the EWC’s to accommodate the difference in VLAN. This further lead me to consider what would be the best approach to configuring redundant internal EWC captive portal that is not managed by ExtremeControl (more detail below) but the Guest polices are managed by XMC i.e. the answer would lead to a variation in approaches I could consider.

Bear in mind I am coming into something already there, rather than from scratch. 

So the customer has two EWC in two different geographic locations. The introduction of Guest internet access via EWC  internal captive portal was introduced, but customer only had one internet connection at one location at the time, so all the AP’s had been homed to one controller to provide the service. 

Later internet connectivity was introduced to the other location. Seems the VLAN ID’s where different at the other location, so to combat that the synchronisation was disabled on the guest polices to accommodate the difference in VLAN ID. 

The same subnet range is being used in both locations, the EWC just splits the DHCP scope into two, one half one side one half the other side. This means the topology cannot be sync’ed either. 

That said the failover works really well, albeit not completely straight under the hood.

The guest traffic bridges at the controller to esa1, which I believe is VLAN’ed to a dedicated internet firewall in the network somewhere. I unfortunately do not have much detail on this, other then so long as I drop traffic onto the guest internet VLAN, supply the default gateway (firewall) to hosts via EWC DHCP scope, its good to go

There is only L3 connectivity between the two sites.

Yes, there is an Extreme Control sitting behind the scenes, but as the EWC is using internal captive portal and the customer doesn’t need to be aware of end-system joining that network (ie be visiable in XMC) so its not being used for guest traffic.

That said, EWC with NAC is being used for corporate SSID’s, so polices are being managed by XMC, including guest polices, hence the query.

I’ve provided some screenshots, so hopefully the above and these provide the detail you need, let me know if you need anything else. The screenshots are taken from one controller but they are pretty much the same on both sides except the topology, the other side has a different L3 IP (172.31.255.202) and the other half of the DHCP scope for the same subnet.

In the screen shots the Guest polices are now in sync, as although the topology for the guest VLAN shows tagged on this controller the other side wasn’t. That meant I could just change the ID to be the same. Now they are in sync.

That does answer my primary question but I don’t think this is the best approach, hence opening up the conversation for ideas.

Many thanks in advance.

[Miguel-Angel_RO]

Hi Martin,

I see a lot of solutions but you should clarify a little bit your architecture:

• Why did you broken the synchronisation between the EWc’s?
  • Is that done on the whole config or only on specific objects?
  • And the main reason is why? 
• Do you use a captive portal?
  • If so we need the details of the topology. A second captive portal could be needed in case of conflicting parameters
• Can you share a topology diagram including EWC, Firewall, routers ?
• What is the connectivity between the two sites?
  • L2 or L3?
• Do you have the Extreme Access Control? If so, you could perfectly use the same rule pointing to the same policy but send, based on the location, different:
  • roles
  • or VLANs using the RFC3580 feature 

Basically you should rephrase your concerns in terms of what you want to achieve instead of what are the issues you see. The second way is closing doors that could let be open.

I’m confident there are ways to achieve what I could feel in your description.

Regards

Mig

[PeterK]

Are you using guest-portal of ewc?

I’m a big fan from separating Policy and VLAN (not using contain to vlan) in case of enterprise-ssid.

There you can send RFC3580 VLAN Tunnel attribute and policy-role via filter-id attribute from radius-server. But I think this wouldn’t help in your case.

Another Idea: Changing VLAN to untagged at ewc you solve your problem, if this is possible.

[StephanH]

Hello Martin,

If you have Radius/Nac in place you can use two different Roles and take the same topology for both Roles.