07-31-2021 02:26 PM
Hello,
I have an AP310i as a VC in a site, where it adopts APs 7522. In addition to the native VLAN 1, I need to deliver IP to two other different VLANs, for that, I created DHCP servers in the controller. This configuration is identical to another site, where I have an RFS6000 as controller, and everything is working correctly, however, with the 310i as VC, the adopted APs do not deliver IP through this DHCP Server.
Here is the running config of AP310i (VC):
!
! Configuration of AP310 version 7.6.2.0-018R
!
!
version 2.7
!
!
client-identity-group default
load default-fingerprints
!
ip access-list BROADCAST-MULTICAST-CONTROL
permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"
permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"
deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"
deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"
deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"
permit ip any any rule-precedence 100 rule-description "permit all IP traffic"
!
mac access-list PERMIT-ARP-AND-IPv4
permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"
permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"
!
ip snmp-access-list default
permit any
!
firewall-policy default
no ip dos tcp-sequence-past-window
no stateful-packet-inspection-l2
ip tcp adjust-mss 1400
!
!
mint-policy global-default
!
meshpoint-qos-policy default
!
wlan-qos-policy default
qos trust dscp
qos trust wmm
!
radio-qos-policy default
!
aaa-policy RADIUS_FOGAS
authentication server 1 host 191.1.10.3 secret 0 fogas123
authentication server 1 proxy-mode through-controller
!
wlan Fogas_Corporativo
description Fogas_Corporativo
ssid Fogas_Corporativo
vlan 1
bridging-mode local
encryption-type ccmp
authentication-type eap
no multi-band-operation
use aaa-policy RADIUS_FOGAS
!
wlan Fogas_Mobile
description Fogas_Mobile
ssid Fogas_Mobile
vlan 40
bridging-mode tunnel
encryption-type tkip-ccmp
authentication-type none
no multi-band-operation
no protected-mgmt-frames
wpa-wpa2 psk 0 Fogas@123
!
wlan Fogas_Visitante
description Fogas_Visitante
ssid Fogas_Visitante
vlan 50
bridging-mode tunnel
encryption-type none
authentication-type none
no multi-band-operation
no protected-mgmt-frames
time-based-access days all start 06:00 end 19:00
!
smart-rf-policy default
no select-shutdown
no smart-sensor
smart-sensor auto-trigger
smart-sensor band smart-band-5GHz
smart-sensor tri-radio-only
!
auto-provisioning-policy APP-FOGAS
adopt ap7522 precedence 1 profile AP-7522 rf-domain default ip 10.8.0.0/16
!
radius-server-policy default
nas 191.1.10.3/32 secret 0 fogas123
!
dhcp-server-policy DHCP_FOGAS
bootp ignore
dhcp-pool vlan40
network 192.168.48.0/24
address range 192.168.48.10 192.168.48.254
default-router 192.168.48.1
dns-server 191.1.10.1 172.28.123.21
dhcp-pool vlan50
network 192.168.58.0/24
address range 192.168.58.10 192.168.58.99
default-router 192.168.58.1
dns-server 8.8.8.8 8.8.4.4
!
!
management-policy default
telnet
no http server
https server
rest-server
ssh
user admin password 1 8553661a49b0c8a0856a3ee27bfc63a1a5a14b39861bdb89af85a547fbb8d899 role superuser access all
snmp-server community 0 private rw
snmp-server community 0 public ro
snmp-server user snmptrap v3 encrypted des auth md5 0 admin123
snmp-server user snmpmanager v3 encrypted des auth md5 0 admin123
!
event-system-policy default
!
profile anyap AP-7522
ip default-gateway 10.8.100.200
no autoinstall configuration
no autoinstall firmware
crypto ikev1 policy ikev1-default
isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ikev2 policy ikev2-default
isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
crypto ikev1 remote-vpn
crypto ikev2 remote-vpn
crypto auto-ipsec-secure
crypto load-management
crypto remote-vpn-client
interface radio1
wlan Fogas_Corporativo bss 1 primary
wlan Fogas_Visitante bss 2 primary
wlan Fogas_Mobile bss 3 primary
interface radio2
wlan Fogas_Corporativo bss 1 primary
wlan Fogas_Visitante bss 2 primary
wlan Fogas_Mobile bss 3 primary
interface radio3
interface bluetooth1
shutdown
mode bt-sensor
interface up1
switchport mode trunk
switchport trunk allowed vlan 1,40,50
interface eth0
interface eth1
interface eth2
interface eth3
interface ge1
switchport mode trunk
switchport trunk allowed vlan 1,40,50
interface ge2
interface fe1
interface fe2
interface fe3
interface fe4
interface vlan1
ip address dhcp
interface pppoe1
use dhcp-server-policy DHCP_FOGAS
use firewall-policy default
use auto-provisioning-policy APP-FOGAS
service pm sys-restart
router ospf
adoption-mode controller
!
profile ap310 default-ap310
ip name-server 191.1.10.1
ip name-server 191.1.10.3
ip name-server 172.28.123.21
ip domain-name fogas.local
ip default-gateway 10.8.100.200
autoinstall configuration
autoinstall firmware
crypto ikev1 policy ikev1-default
isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ikev2 policy ikev2-default
isakmp-proposal default encryption aes-256 group 2 hash sha
crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
crypto ikev1 remote-vpn
crypto ikev2 remote-vpn
crypto auto-ipsec-secure
crypto load-management
crypto remote-vpn-client
interface radio1
wlan Fogas_Corporativo bss 1 primary
wlan Fogas_Mobile bss 2 primary
wlan Fogas_Visitante bss 3 primary
antenna-mode 2x2
interface radio2
wlan Fogas_Corporativo bss 1 primary
wlan Fogas_Mobile bss 2 primary
wlan Fogas_Visitante bss 3 primary
antenna-mode 2x2
interface bluetooth1
shutdown
mode le-sensor
interface ge1
description "Vlan Rede Local"
interface ge2
description "Vlan Rede Sem Fio"
interface vlan1
ip address dhcp
ip dhcp client request options all
interface pppoe1
interface usb0
use dhcp-server-policy DHCP_FOGAS
no use firewall-policy
ntp server a.ntp.br
use client-identity-group default
no virtual-controller management-interface ip address
logging on
service pm sys-restart
router ospf
adoption-mode controller
!
rf-domain default
location Cuiaba
contact suporte@fogas.com.br
timezone Etc/GMT-4
country-code br
ad-wips-wireless-mitigation disable
ad-wips-wired-mitigation disable
!
ap7522 94-9B-2C-2A-DB-AC
use profile AP-7522
use rf-domain default
hostname AP-CGB02-ADM01
area Administracao
floor Administracao
interface vlan1
ip address 10.8.5.1/16
ip address zeroconf secondary
!
ap310 20-9E-F7-78-F5-91
use profile default-ap310
use rf-domain default
hostname AP-CGB-ADM01
area CONTROLLER
use radius-server-policy default
interface radio1
wlan Fogas_Corporativo bss 1 primary
wlan Fogas_Visitante bss 2 primary
wlan Fogas_Mobile bss 3 primary
ldpc
interface radio2
wlan Fogas_Visitante bss 1 primary
wlan Fogas_Mobile bss 2 primary
wlan Fogas_Corporativo bss 3 primary
ldpc
interface ge2
switchport mode trunk
switchport trunk allowed vlan 1,40,50
switchport trunk native vlan 1
interface vlan1
ip address 10.8.5.2/16
ip address zeroconf secondary
interface vlan40
ip address 192.168.48.3/24
interface vlan50
ip address 192.168.58.3/24
use dhcp-server-policy DHCP_FOGAS
no use auto-provisioning-policy
virtual-controller
rf-domain-manager capable
no adoption-mode
!
!
end
Solved! Go to Solution.
08-03-2021 04:53 PM
From the CLI of one of the 7522’s, try running this:
enable
service pktcap on bridge filter port 67 and port 68
The output will show the actual DHCP traffic bridging through the AP. My guess is that either the OFFER is not making it back or the client’s REQUEST isn’t going out.
08-04-2021 08:11 PM
From port 68 to 67 I got this:
10 17:04:47.831224 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 306, DHCP Discover from 8C-45-00-83-6A-BC, DF, DSCP 4
11 17:04:49.917764 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 306, DHCP Discover from 8C-45-00-83-6A-BC, DF, DSCP 4
12 17:04:50.573403 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 310, DHCP Discover from A4-63-A1-58-EE-12 for 192.168.59.251, DSCP 0
13 17:04:52.599713 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 320, DHCP Discover from 52-6F-8E-CF-9F-4B, DF, DSCP 4
14 17:04:52.739498 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
15 17:04:53.620045 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 320, DHCP Discover from 52-6F-8E-CF-9F-4B, DF, DSCP 4
16 17:04:53.761857 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
17 17:04:54.163434 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 306, DHCP Discover from 8C-45-00-83-6A-BC, DF, DSCP 4
18 17:04:54.399734 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 310, DHCP Discover from A4-63-A1-58-EE-12 for 192.168.59.251, DSCP 0
19 17:04:54.760749 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 312, DHCP Discover from A8-DB-03-EE-31-2A, DF, DSCP 4
20 17:04:55.447080 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 294, DHCP Discover from 0E-05-F7-27-D0-2A, DF, DSCP 4
21 17:04:55.560933 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 320, DHCP Discover from 52-6F-8E-CF-9F-4B, DF, DSCP 4
22 17:04:55.687330 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
23 17:04:59.383870 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 310, DHCP Discover from A4-63-A1-58-EE-12 for 192.168.59.251, DSCP 0
And 67 to 68:
10 17:05:42.188657 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 294, DHCP Discover from 0E-05-F7-27-D0-2A, DF, DSCP 4
11 17:05:42.902674 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from 36-3B-4C-2E-A5-8D, DF, DSCP 4
12 17:05:43.199825 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
13 17:05:44.307935 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
14 17:05:44.899103 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from 36-3B-4C-2E-A5-8D, DF, DSCP 4
15 17:05:45.573458 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 320, DHCP Discover from 52-6F-8E-CF-9F-4B, DF, DSCP 4
16 17:05:46.263094 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
17 17:05:47.750456 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 308, DHCP Discover from 70-FD-46-55-B4-20, DF, DSCP 4
18 17:05:48.656315 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from 36-3B-4C-2E-A5-8D, DF, DSCP 4
19 17:05:50.102281 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
20 17:05:50.433774 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 294, DHCP Discover from 0E-05-F7-27-D0-2A, DF, DSCP 4
21 17:05:53.407806 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 320, DHCP Discover from 52-6F-8E-CF-9F-4B, DF, DSCP 4
22 17:05:55.215486 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 308, DHCP Request from 98-CA-33-91-12-86 to 0.0.0.0 for 192.168.59.234/0.0.0.0, DSCP 0
23 17:05:56.527166 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 300, DHCP Discover from 30-FC-EB-75-83-0F, DF, DSCP 4
24 17:05:56.993740 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from 36-3B-4C-2E-A5-8D, DF, DSCP 4
25 17:05:57.022513 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 308, DHCP Request from 98-CA-33-91-12-86 to 0.0.0.0 for 192.168.59.234/0.0.0.0, DSCP 0
08-03-2021 04:53 PM
From the CLI of one of the 7522’s, try running this:
enable
service pktcap on bridge filter port 67 and port 68
The output will show the actual DHCP traffic bridging through the AP. My guess is that either the OFFER is not making it back or the client’s REQUEST isn’t going out.
08-03-2021 04:24 PM
Understood, currently I've changed it to local, in both VLANs, in addition, I also disabled the DHCP service directly in the profile of the APs 7522, leaving only the 310i. Despite this, clients still don't get IP from the 7522 APs.
08-03-2021 04:04 PM
For reference, this is what I’m talking about, regarding the tunneling option of the wlan:
wlan Fogas_Visitante
description Fogas_Visitante
ssid Fogas_Visitante
vlan 50
bridging-mode tunnel
encryption-type none
authentication-type none
no protected-mgmt-frames
It sounds like maybe you are not familiar with this bridging mode. To be clear, a tunneled wlan like this will force the wireless client’s traffic to be carried over a MiNT tunnel to another MiNT capable device - normally the WiNG controller, where it is then unpacked and dropped onto the proper VLAN that exist on the controller’s interface. In this case, the controller is the AP310i VC.
A “local” bridged wlan will simply take wireless client traffic and bridge it directly onto the assigned VLAN on the APs ge1/ge2 interface, where it then makes its way to the switch and is then treated like normal LAN traffic.
The problem here is that a VC AP does not support a data plane, which is what is needed to be able to process the wireless client traffic coming back via the MiNT tunnel. So when using an AP as a VC, all of your wlans MUST be configured for “local” bridging mode.