AP7632 Bridge Mode in VC System Profile

[Autobar]

Hi,

We are using AP7632 and configured the Dynamic VC, and created the Auto provisioning P Policy.

The devices are succeffuly adopted, now the issue is that we need to establish Bridge on Radio2 i.e. 5GHz. But neither in RV mode there apears the ‘Brdige Mode”, nor there is “Client Bridge” option appears at Radio2 interface config page.

I had tried even device override config, but it doesn't apply as well.

Below please find the configuration.

!
! Configuration of AP7632 version 5.9.2.5-001R
!
!
version 2.6
!
!
client-identity-group default
 load default-fingerprints
!
ip access-list BROADCAST-MULTICAST-CONTROL
 permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"
 permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"
 deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"
 deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"
 deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"
 permit ip any any rule-precedence 100 rule-description "permit all IP traffic"
!
mac access-list PERMIT-ARP-AND-IPv4
 permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"
 permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"
!
ip snmp-access-list default
 permit any
!
firewall-policy default
 no ip dos tcp-sequence-past-window
 no stateful-packet-inspection-l2
 ip tcp adjust-mss 1400
!
!
mint-policy global-default
!
meshpoint-qos-policy default
!
wlan-qos-policy default
 qos trust dscp
 qos trust wmm
!
radio-qos-policy default
!
wlan wlan1
 ssid Autobar1
 vlan 1
 bridging-mode local
 encryption-type tkip-ccmp
 authentication-type none
 wpa-wpa2 psk 0 123456789
!
smart-rf-policy default-smartrf
 no select-shutdown
!
auto-provisioning-policy VC
 adopt anyap precedence 1 profile IndoorAP rf-domain $AUTO-RF-DOMAIN any  
!
!
management-policy default
 telnet
 no http server
 https server
 rest-server
 no ftp
 ssh
 user admin password 1 20fad3f875c4c6e30fcba669c28ba6e4cdd0d3279ad6bfa9595ca1d985cdafd8 role superuser access all
 snmp-server community 0 private rw
 snmp-server community 0 public ro
 snmp-server user snmptrap v3 encrypted des auth md5 0 admin123
 snmp-server user snmpmanager v3 encrypted des auth md5 0 admin123
!
nsight-policy default
!
profile anyap IndoorAP
 no autoinstall configuration
 no autoinstall firmware
 crypto ikev1 policy ikev1-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ikev2 policy ikev2-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
 crypto ikev1 remote-vpn
 crypto ikev2 remote-vpn
 crypto auto-ipsec-secure
 crypto load-management
 crypto remote-vpn-client
 interface radio1
  wlan wlan1 bss 1 primary
 interface radio2
 interface radio3
 interface bluetooth1
  shutdown
 interface up1
 interface ge1
 interface ge2
 interface fe1
 interface fe2
 interface fe3
 interface fe4
 interface vlan1
  ip address dhcp
  ip dhcp client request options all
 interface pppoe1
 use firewall-policy default
 use auto-provisioning-policy VC
 ntp server 2.asia.pool.ntp.org 
 virtual-controller auto
 virtual-controller management-interface ip address 192.168.1.10/24
 rf-domain-manager capable
 service pm sys-restart
 router ospf
 adoption-mode controller
!
profile ap7632 default-ap7632
 autoinstall configuration
 autoinstall firmware
 crypto ikev1 policy ikev1-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ikev2 policy ikev2-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
 crypto ikev1 remote-vpn
 crypto ikev2 remote-vpn
 crypto auto-ipsec-secure
 crypto load-management
 crypto remote-vpn-client
 interface radio1
  wlan wlan1 bss 1 primary
  antenna-mode 2x2
 interface radio2
  antenna-mode 2x2
  bridge ssid BRIDGE
  bridge encryption-type ccmp
  bridge wpa-wpa2 psk 0 123456789
 interface bluetooth1
  shutdown
 interface ge1
 interface vlan1
  ip address dhcp
  ip address zeroconf secondary
  ip dhcp client request options all
 interface pppoe1
 use firewall-policy default
 use client-identity-group default
 virtual-controller auto
 virtual-controller management-interface ip address 192.168.1.10/24
 rf-domain-manager capable
 logging on
 service pm sys-restart
 router ospf
 adoption-mode controller
!
rf-domain default
 timezone Asia/Karachi
 country-code pk
 use smart-rf-policy default-smartrf
 use nsight-policy default
!
ap7632 94-9B-2C-E7-21-92
 use profile IndoorAP
 use rf-domain default
 hostname ap7632-E72192
!
ap7632 94-9B-2C-E7-2A-FC
 use profile IndoorAP
 use rf-domain default
 hostname ap7632-E72AFC
!
!
end
 

[ckelly]

Try adding to interface radio 2:

bridge channel-list 5GHz <channel(s)>  (36,40,44...whichever 5GHz channels you want to allow)

Otherwise, the rest of the config looks correct.

[Autobar]

Thanks Kelly,

Fortunately the GUI option is visible in Default profile only, so I tried Bridge in that profile, though no success yet.

Please review it below, and let see if we can figure out in this mode, as a demo is scheduled with one of ISP for the same, and any impression out of our claim will be a bad impression.

!
! Configuration of AP7632 version 5.9.6.0-007R
!
!
version 2.7
!
!
client-identity-group default
 load default-fingerprints
!
ip access-list BROADCAST-MULTICAST-CONTROL
 permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"
 permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"
 deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"
 deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"
 deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"
 permit ip any any rule-precedence 100 rule-description "permit all IP traffic"
!
mac access-list PERMIT-ARP-AND-IPv4
 permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"
 permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"
!
ip snmp-access-list default
 permit any
!
firewall-policy default
 no ip dos tcp-sequence-past-window
 no stateful-packet-inspection-l2
 ip tcp adjust-mss 1400
!
!
mint-policy global-default
!
meshpoint-qos-policy default
!
wlan-qos-policy default
 qos trust dscp
 qos trust wmm
!
radio-qos-policy default
!
wlan wlan1
 ssid Autobar1
 vlan 1
 bridging-mode local
 encryption-type tkip-ccmp
 authentication-type none
 wpa-wpa2 psk 0 123456789
!
smart-rf-policy default-smartrf
 no select-shutdown
!
auto-provisioning-policy VC
!
!
management-policy default
 telnet
 no http server
 https server
 rest-server
 no ftp
 ssh
 user admin password 1 20fad3f875c4c6e30fcba669c28ba6e4cdd0d3279ad6bfa9595ca1d985cdafd8 role superuser access all
 snmp-server community 0 private rw
 snmp-server community 0 public ro
 snmp-server user snmptrap v3 encrypted des auth md5 0 admin123
 snmp-server user snmpmanager v3 encrypted des auth md5 0 admin123
!
nsight-policy default
!
profile anyap Indoor_AP
 no autoinstall configuration
 no autoinstall firmware
 crypto ikev1 policy ikev1-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ikev2 policy ikev2-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
 crypto ikev1 remote-vpn
 crypto ikev2 remote-vpn
 crypto auto-ipsec-secure
 crypto load-management
 crypto remote-vpn-client
 interface radio1
 interface radio2
 interface radio3
 interface bluetooth1
  shutdown
  mode le-sensor
 interface up1
 interface ge1
 interface ge2
 interface fe1
 interface fe2
 interface fe3
 interface fe4
 interface pppoe1
 use firewall-policy default
 ntp server 2.asia.pool.ntp.org 
 virtual-controller auto
 virtual-controller management-interface ip address 192.168.1.10/24
 rf-domain-manager capable
 service pm sys-restart
 router ospf
 adoption-mode controller
!
profile ap7632 default-ap7632
 autoinstall configuration
 autoinstall firmware
 crypto ikev1 policy ikev1-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ikev2 policy ikev2-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
 crypto ikev1 remote-vpn
 crypto ikev2 remote-vpn
 crypto auto-ipsec-secure
 crypto load-management
 crypto remote-vpn-client
 interface radio1
  wlan wlan1 bss 1 primary
  antenna-mode 2x2
 interface radio2
  rf-mode bridge
  antenna-mode 2x2
  bridge ssid BRIDGE
  bridge encryption-type ccmp
  bridge wpa-wpa2 psk 0 1234567890
 interface bluetooth1
  shutdown
  mode le-sensor
 interface ge1
 interface vlan1
  ip address dhcp
  ip address zeroconf secondary
  ip dhcp client request options all
 interface pppoe1
 use firewall-policy default
 use client-identity-group default
 virtual-controller auto
 virtual-controller management-interface ip address 192.168.1.10/24
 rf-domain-manager capable
 logging on
 service pm sys-restart
 router ospf
 adoption-mode controller
!
rf-domain default
 timezone Asia/Karachi
 country-code pk
 use smart-rf-policy default-smartrf
 use nsight-policy default
!
self
! ap7632 94-9B-2C-E7-21-92
 radio-count 2
 use profile default-ap7632
 use rf-domain default
 hostname ap7632-E72192
 license AP VIRTUAL_CONTROLLER_DEFAULT_AP_LICENSE
 model-number AP-7632-680B40-WR
 adoption-site 94-9B-2C-E7-2A-FC
!
ap7632 94-9B-2C-E7-2A-FC
 radio-count 2
 use profile default-ap7632
 use rf-domain default
 hostname ap7632-E72AFC
 license AP VIRTUAL_CONTROLLER_DEFAULT_AP_LICENSE
 model-number AP-7632-680B40-WR
 adoption-site 94-9B-2C-E7-21-92
!
!
end
 

[ckelly]

Autobar,

I can see the ‘bridge’ option available as part of the 7632’s CLI configuration….and I can see the ‘bridge’ option available on a controller’s (NX) GUI for an AP7632

This may just be a GUI issue with the 7632 itself.

Try configuring radio-2 for bridge mode by using the CLI and see if that works.  If it does, then it’s just a GUI problem.

This is the basic setup for an AP to operate in client bridge mode (the radio settings)

login to the CLI on the 7632

enable

configure

profile ap7632 <profile name for client bridge profile>

interface radio 2

rf-mode bridge

bridge ssid <SSID to connect to>

bridge encryption-type ccmp

bridge wpa-wpa2 psk 0 <pre-shared-key>

commit write

[Autobar]

Thanks Robert for your support and reply.

But still after up gradation to 5.9.6.0, in my new created Profile “IndoorAP” the RF mode option for “Bridge” is not visible.

even though I deleted it and recreated it.