Wireless Access

Hello everyone

I have a particular setup I want to discuss/get input from the community on. I have a customer in the works of moving from a VPN infrastructure to use Aruba and RAP-5. The customer have many offices geographically spread across out country. For the moment it's about 40-50 very small offices.

We now have a RAP-5 in place at all the offices, running fine with WLAN and using the Ethernet ports for printers etc.

The customer has insisted on having a separate IP subnet for WLAN and cable on each site. This totals a lot of VLAN and also wants to use Aruba as DHCP for these VLANs. The reason for using Aruba as DHCP is that the customer don't have a good infrastructure behind at the moment, but moving to a full AD, RADIUS etc.

They also want to have separate VLAN for WLAN/cable for each site, for easier troubleshooting. If a customer with the given IP is having problems they will instantly know which location the problem is at. I have told them that this is not an optimal solution, but VLAN wise and DHCP wise.

That have 2 3x00 controllers which shall be in a master-standby setup when things are up and running. But because of the sheer number of VLANs and especially DHCP scopes, I see a problem when running controllers in VRRP.

The DHCP scopes with 254 hosts is clearly an overkill at each location, but for the standby to work correctly and not having 2 DHCP servers on the same VLAN, what is the recommended setup for this.

If the master fails, the standby should have the same VLAN and same scope so that users can reach their local printer etc.

I know this is not the ideal setup and I have made that clear to the customer, but as we know the customer always is correct :D

I was thinking about splitting the scope in 2, putting the 2 parts on each controller.

The real problem is that I might need to add one VRRP instance for each DHCP scope to have a VRRP IP for each DHCP to use as gateway.

Hope anyone can brainstorm a bit with me to setup this in a somewhat sensible way.

Roar Fossen

Okay.

How many devices at each site?  Maybe the rule can be that only sites that rise above "x" number of clients deserve their own VLAN.  When a device or user associates to the WLAN, it says what AP they are connected to, so there is less value to dedicating a VLAN to each site, creating a vrrp, etc...

The customer should use an external router at the headend site for routing because it is simpler to manage.

If you have two controllers that use master-standby through a firewall, the firewall will NOT allow you to do a static NAT to a vrrp.  You will have to use an external DNS a-record and pre-populate the a-record two two addresses and point the AP to that a-record externally for redundancy.  Each controller will require its own statically Natted Public address.

Aruba has written a Validated Reference Design on Remote APs.  It can be found here:  

http://www.arubanetworks.com/technology/reference-design-guides/

It has quite a few ideas about how to deploy Remote APs that you can use, in addition to what others will answer here.

Hi

Well, the number of devices at each site is very low, i would guess about 5 devices, most of them on cable behind the RAP-5. The customer is a company changing your front window on your car, so most of the users are just a few computers.

On the WLAN it's mostly customers waiting for their car, so the guest network is in the air, but this network has only on VLAN and one DHCP scope.

All the RAP's use a URL (no IP) for getting back to the designated master controller, so this part is covered with two firewalls, because the controllers will be placed at 2 geographically separated sites. So this bit i'm not concerned about.

Idealy i would like to use one VLAN for the employee WLAN and one VLAN for cable serving employee computers and printers. And in turn only one DHCP scope for each VLAn aswell, but the customer is not convinced yet. They do have an evalution of AirWave, so troubleshooting should not be a problem, location wise.

The point of this tread is to look at Aruba recommendations and show this to the customer for leverage, to maybe change the structure of the setup.

I shall have a closer look at the RAP VRD to see if i can relate some of it to the customers setup.

Another question for you, i have seen the recommendation from Aruba that one should not have a bigger DHCP scope than 512 hosts. I have not seen why this is so, and is there a recommendation of number of scopes? Is it processing power that is the problem or what?

Roar Fossen

The internal DHCP server is only sized/designed for a guest network.  You can always point to an external DHCP server to handle that with no issue.

I understand, the point is that the customer is rebuild their whole infrastructure at the moment, moving servers etc out of office.

I would like to point out the same exact thing you said, by using an external DHCP. By using an external DHCP one would at all times have a DHCP on the VLAN, regardless of which controller is master.

Thanks anyway Colin

Roar

Another question for you, i have seen the recommendation from Aruba that one should not have a bigger DHCP scope than 512 hosts. I have not seen why this is so, and is there a recommendation of number of scopes? Is it processing power that is the problem or what?

I belive the main reason is to reduce broadcast domain as all the users will share the same air time/bandwidth. That is why ARUBA recommend using VLAN Pool.

Hi

I fully agree with Aruba regarding the size of the broadcast domain and I use VLAN pooling in those situations that I need more hosts than 512. I was also wondering if the same goes for the number of scopes.

In my head the number of scopes should be limited, but for this setup we have a lot.

Can this affect the DHCPd daemon or what?

I will strongly ask the customer to reconsider the structure, but for as now the system looks to be running fine with the scopes at hand

Thanks anyway guys

Roar

Hi Mosher,

I found the following for you which might be a good start to go through:

please note that those are information from Microsoft which they use in their own dedicated dhcp server (not a MC or router used for DHCP server).

How to determine the number of DHCP servers to use

Server and network configuration

Test details

Test results

Aruba has limited the number of supported internal DHCP leases in their controller platforms to 512 because the internal DHCP server was only designed to support smaller guest networks,  not an enterprise.  It is not a problem to put a helper-address on a VLAN interface and have an external DHCP server provide services for thousands of clients in an Aruba System.  

This is stated in the 6.1.3.x release notes under "Known Issues".

The size of the broadcast domain is a separate network design issue.

Hi

Yes, I have seen the 512 limit. What do I do when I have a master-standby setup with say a guest net of 254 hosts?

In this scenario Master is the DHCP for the guests, can I run the DHCP server on the standby with the same subnet? To have the guests in the same vlan/subnet I will need the same subnet on both controllers when the master fails.

Roar

If you have a master/standby with DHCP you should use an external DHCP server.  If a single controller is providing DHCP and at one time, it goes away, none of your clients are going to get an ip address.  If you are using ip nat inside for your guest clients on both controllers, you can run dhcp on both controllers because the clients on either controller will never see each other (only one controller will be actively providing client access at a time).  If you are NOT running ip nat inside on your guest subnet, you need to use an external DHCP server to provide redundancy and consistency.

Hi Joseph,

I get your point in using DHCP in both MC if ip nat inside is enabled because the DHCP request will not reach the other controller.

However, incase the 1st MC goes down and the 2nd MC take action as DHCP will it face any problem when it starts providing IP addresses to new users, will it try by mistake send already used IP-address or will it 1st check the availability of this address, in addition if it noticed that this ip address is being used will it blacklist it or something OR it will just jump to the next ip address ?

You will have duplicate address issues.  Best to use an external DHCP server.

I see. Ok, I have a solution on my mind to this and I want you to evaluate it, please.

in case we need to have 254 guest users.

we will create a vlan pool with two vlans inside.

Vlan 2: 10.0.1.0 255.255.255.0

Vlan 3:10.0.2.0 255.255.255.0

MC-1 will assign IP address for both Vlan 2 and 3 as follow:

Vlan 2 from 10.0.1.1 to 10.0.1.127

Vlan 3 from 10.0.2.1 to 10.0.2.127

MC-2 will assign IP address for both Vlan 2 and 3 as follow:

Vlan 2 from 10.0.1.128 to 10.0.1.254

Vlan 3 from 10.0.2.128 to 10.0.2.254

this way, I belive, duplication will not exist.

Can we specify the start and end of each DHCP and I hope that MC (1 and 2) will not exchange those information

That *might* work.

Hi

About this 512 hosts limit for the DHCP. Is this a total limit for the whole system or just for each scope?

If this is a total limit i will need to re-design the customers system with external DHCP servers (what i wanted in the first place).

Roar

That is for each controller.  It WILL work with more than 512 clients using DHCP, but 512 is a safe number.