Same policy, different rules how do I manage

[Anonymous]

Hi,

Scenario is that I have 2 x EWC’s. Each of these are in different locations.

Each location has its own internet connection for bridge@ewc for guest internet traffic.

DHCP is being provided by EWC. One large scope has been created and split between each of the controllers.

The issue is the VLAN ID is different in each location. That means the contain to VLAN is different for the same roles on each controller.

The ‘sync’ on the EWC has been removed for those roles between each of the controller because the VLAN ID’s are different. 

The problem is this is creating an issue with policy because you have the same policy with different configuration on each controller, so the policy verification is failing and I can’t get EWC and Policy to sync with that configuration.

Only solution I can think of is change the VLAN ID on both sides to match.

Just wondering if anyone had a better idea, save the trouble I could have in getting the VLAN changed.

Many thanks in advance.

[Miguel-Angel_RO]

Hi Martin,

The main issue I see is that we are cheating with the controller to make it think that the network behind (fw) is the same in both sites while it is not.

We are in fact abusing the system and taking advantage of a “working but not expected behaviour”.

The risk is that at some point in time something changes in the infrastructure (VLAN/subnet/scope/default gw) and then the sh*t hits the fan…

In such simple environment I encourage the customer to put the splash screen and the DHCP scope on the firewall. The WLAN is the just a L2 bridge with no L3/CP/DHCP/etc. Here it would be a dedicated splash/subnet/scope per FW.

I wouldn’t care about a smooth/transparent fail-over for a guest Internet with no authentication.Ì would on the other SSIDs with authentication.

In your specific case, the EWC has no added value and in fact it is increasing the entropy of your system.

Cheers

Mig

[Anonymous]

Hi Mig,

Thanks for taking the time to look at this, its been extremely helpful and believe I have the detail I need now. 

The network is vast and don’t have much detail on it, although it is inconsequential in this case. The sites are joined together at layer 3 but it does not matter as guest traffic is bridging out to a VLAN / Network and firewall that are completely independent of each other.

The DHCP scope was something I was aware of and do use, whether its right or wrong is up for question.

The way it works is because the two VLANs either the same or different ID’s are effectively not joined in anyway, they are just VLANs that go to two completely independent firewalls and circuits. This means they can be configured with the same subnet and not clash with one another.

The way it works is that you take one large scope, you split the allocation of addresses in half. One side provides address in one range (lower half), the other side does the same (higher half). The primary reason is that when the APs fail from one side to the other (whether 50/50 split or all home to one) the client can keep the same IP, it wont clash with anything on the controller, the DHCP scope keeps them separate. In addition if a client gets an IP when in failover, when it fails back it can keep it until lease runs-out and still work without clashing.

That way the failover is seamless, the device doesn’t need to re-ip and client carries on working without being aware of the fail-over. It isn’t completely fall-proof, but think it takes best advantage of the fact traffic has effectively moved to a completely different location and firewall.

What do you think, maybe not the best idea?

Cheers.

[Miguel-Angel_RO · Accepted solution]

Martin,

Here my understanding:

• two sites with their own internet access VLAN666 and VLANxxx
• One WLAN “Guest-WiFi” B@EWC NOT SYNCHRONIZED
  • This means that the two WLANs are independent
  • so we can have the same SSID (for consistency) with different VLAN IDs and different subnets and DHCP scopes
• What I would suggest is to:
  • Synchronize all objects (for redundancy) but the WLAN “Guest-Internet”
  • Create 4 roles keeping the ACLs only for the local CP:
    • Guest Unauthenticated-Site1
      • VLAN = 666
    • Guest Unauthenticated-Site2
      • VLAN = xxx
    • Guest Access-Site1
      • VLAN = 666
    • Guest Access-Site2
      • VLAN = XXX
  • Create two different VNS
    • Guest-Internet-Site1
      • WLAN = Guest-WiFi
      • Non Auth Role = Unauthenticated-Site1
      • Auth Role = Access-Site1
    • Guest-Internet-Site2
      • WLAN = Guest-WiFi
      • Non Auth Role = Unauthenticated-Site2
      • Auth Role = Access-Site2
• It has been a while I migratd to XCA/XCC so I don’t remember by heart the captive portal settings. If I remeber well you’ll have to create one captive portal per site pointing to the ip address of the local topology (666 or xxx)

With this you should have a synchronized infra except for the WLAN pointing to the local CP/VLAN/Roles.

One point not clear is the subnet of the CP.

If it is a different VLAN, the DHCP scope cannot be part of the same subnet. You should have two different subnets/scopes/VLANs and of course, firewalls (one on each site).

I’m still missing the topology diagram.

Mig

[Anonymous]

Hi Mig,

No idea, seems its asking for trouble being 666 🙂

Regarding guest access, no NAC involvement at all, just internal EWC captive portal using guest splash. Screenshot below.

The other corporate SSID’s due use NAC extensively, hence why I need to manage all the polices including Guest Access via XMC. The polices are just being assigned to end-systems based on the roles defined in the VNS settings (added below)

Screenshots also added showing the other controllers topology configuration

The topology below used to have a VLAN ID of 466 configured, but because it was untagged I just changed to match the other of 666.

Thanks