Controllerless Networks

Hello,

I am trying to create a DHCP scope for an SSID on an Aruba IAP-205. I need to use DHCP option 252, I have tried most of the options L2, Local etc but I can't get it to work. Is this possible and if so what do I set on IAP to do this?

I also need the IAP to use NAT on th SSID.

HI,

I don't believe it's possible to set DHCP option 252 on an instant access point. I'm assuming you're attempting to deploy proxy setting in this way? 

Cheers

James

Yes, we are trying to provide the location of the PAC file for the proxy.

I would highly recommend seeking an alternative way of proxying the traffic rather than deploying a PAC file. I've found it hit and miss if devices support this.

If at all possible I'd look into transparently proxying the traffic. Many proxy servers have transparent proxy capabilities.

http://en.wikipedia.org/wiki/Proxy_server#Transparent_proxy

Cheers

James

The customer already has a Censornet proxy installed.

If we could change the default gatewate of the addresses given to the client from IAP to the address of the Censornet proxy then this should also work but I can't get this working either. Is is possible for the IAP to provide DHCP addresses to clients with a different gateway address and what are the implication of doing this if using NAT on the VC? The customer network is a single flat layer 2 network.

If you're using source-NAT on the VLAN on the IAPs then the gateway will become the access point gateway when the traffic leave the access point onto the wirted network.

Does that make sense?

Yes that I what I thought.

I need a way of routing everything from the SSID to Censornet or making the clients on the SSID have a GW address of the Censornet box. I have spoken to Censornet and they said the defualt gateway option is better.

---

@jrwhitehead wrote:

If you're using source-NAT on the VLAN on the IAPs then the gateway will become the access point gateway when the traffic leave the access point onto the wirted network.

 

Does that make sense?

 

---

Changing the default gateway on the access point will do this.

Warning: I'm not familiar with your network so do not know what the implications of changing this are!

Thisis still being a problem. I have tested changing the defualt gateway of the AP but this does not change the default gateway given to clients, apprently this is becuase of the "Magic' VLAN. 

Is there any way of changing the default gateway of the Magic VLAN? 

The way the Magic Vlan works is causing me loads of issues.

JazzyT

Magic vlan traffic is always source natted out of the Virtual controller, so you cannot change the default gateway of clients.  You need to put the traffic on a Network assigned VLAN (trunk) and make that VLAN do what you need to for your clients.

Thanks Colin, the problem is the customer has flat network. They need 1 group of clients on one SSID to get a DHCP address from their network and anther set of client to get an address with a different gateway for their traffic is set to the Internet through a Censornet web filter. This would be very easy if they implemented VLAN's.

We tried another setup on the IAP DHCP server, this seamed to work but then we found out the IAP was also giving out addresses to wired clients.

I think the only option is to VLAN the network but it is quite large.

I have something similiar at a customer site.  They have a flat network with 2 isps.  They want "guest" ssid traffic to go to one isp and their employee ssid (dhcp being furnished from windows) to go to the other isp.  I manually changed the IP address on each IAP and used the "Guest" isp address for the default gateway.  I then set the other gateway in the DHCP scope on the windows server.  The "Guest" ssid network is virtual controller assigned and the traffic will go out the gateway assigned on the IAP.  This has worked for me, but your circumstance may be a little different.  I have tested using traceroute and see traffic flowing to the proper gateway when connected to each SSID.  
 

We are looking into trying to stop using our old DHCP servers and use our Aruba 335's to handle our DHCP. 

Is this an easy prosses? What are the steps for this?

We are trying to troubleshoot some issues we are having and looking into our options.

Thanks!

Hello,

We are looking into trying to stop using our old DHCP servers and use our Aruba 335's to handle our DHCP. 

Is this an easy prosses? What are the steps for this?

We are trying to troubleshoot some issues we are having and looking into our options.

Thanks!

Honestly the DHCP server that is internal to an IAP is not nearly as configurable or manageable as an external DHCP server, so features will be lacking.  The internal DHCP server is really only intended for a guest network.

Thank you for the info.  

I wish I was better at all this stuff, Thank you so much for all the help!

Ok, so it sounds like this would not be the best road to go down for our main network. Are there any large advantages to do this on our guest network?

Thanks!

The advantage would be that you would expose less of your infrastructure (DHCP) to guests, perhaps.  If you already have a system in place, it might not be to your advantage to want to change now.

Thank you for the info.

Ok, we will hold off on making a change to the network as it will not be our best move to make at this time. 

Thank you for all the help!