Wireless Access

2 x 3400B controllers in master/local config

ArubaOS - 6.1.2.2

Core Switch = HP Procurve 5400 Series

VOIP System = Avaya IP 500 with 9611G phones

My controllers have 3 vlans defined :

300 - Data Vlan

310 - Guest Wireless Vlan

350 - Voice Vlan

My Aruba rap is setup and working to broadcast SSID's.  The ETH1 port is also setup so that if i plug a laptop in it, it gets a DHCP address (from a windows server) on my Data Vlan.  When i plug a phone in, it boots and never switches over to the voice vlan.

Even when i set the ETH1 Profile to Trunk, set the native to 300 and allowed to 350 it still will not work.

One strange thing :

When i am connected at my corporate location, wirelessly, to the 300 data vlan...........i can ping the 350 vlan no problem.  When i am at home, connected to the same SSID on the same 300 vlan (through the RAP), i CANNOT ping anything on the 350 vlan.

HP handles "trunking" differently than cisco.  The ports that the controller are connected to are :

untagged vlan 300

tagged vlan 350

Any thoughts?

Do we have dot1q enabled on Avaya9611g phone itself; please verify and make sure we have the default settings been configured on the phone itself.

When you connect the Avaya phone to E1 port on corporate location works fine however doesnt work on the home? Please confirm as you had mentioned wirelessly it works fine.

What happens if you configure the E1 to access vlan 350 and connect laptop to see if we get ip address?

Are we using option 176 defined on the DHCP server? If yes, can you post the configuration.

Please make sure HP switch is not tagging the native vlan as well. Also can you post the configuration of E1 defined on the controller?

Also specify the RAP forwarding mode tunnel/bridge/split-tunnel. Thanks!

Currently -

eth 1 is configured

Forward Mode - TUNNEL

Switchport Mode - ACCESS

Access Mode Vlan - 350

Wired AP Enable is checked

Broadcast is checked

Thanks for the info. Is the phone gets the IP address if we introduce the switch in the middle between rap e1 port and phone ?

Can we try configuring E1 port set to trunk mode with native vlan as data vlan 300 and tag the voice vlan 350.

From the previous post, I understand this doesn't work, may I know what is the error message you get on the phone itself ?

Did we try setting up the static IP parameters on one of the test phone itself to see if phones comes up?  If no, it would be great to connect the dumb hub to the RAP and then connect the laptop and phone to it, run the pcap to understand VLAN tag info.

Also do the port monitor running the pcap on the port to which Cisco phone is connected on the local network and compare the captures between working VS. non-working one.

I can try taking a dumb switch to the remote location today.

What you are asking is for me to put the switch between the RAP and the PHONE - and then run a packet capture? 

Yes, that`s right. 

Here are some notes

Current config of E1 is :

Tunnel

Trunk

Native = 300 (data)
Tagged = 350 (voice)

I tried putting dumb switch between RAP and phone, and it still does not get an IP address.

Setting static IP on the phone, the phone will still not come up.  It sits on "discovering xx.xx.xx.xx (address of phone server interface"

On my controller i am using 3 interfaces, plugged physically into my core switch

1/0 - configured as ACCESS - vlan 300 (data)

1/1 - configred as ACCESS - vlan 350 (voice)

1/2 - N/A

1/3 - configured as ACCESS - vlan 310 (guest wireless)

The port on my core switch for interface 1/1 on the controller is configured as :

interface J4
   name "Aruba Master Voice"
   tagged vlan 350
   untagged vlan 300
   exit

With this configuration..............i CANNOT ping anything on the voice vlan even from the controller.

If i change the core switch port to UNTAGGED 350............then i can ping vlan 350 from the controller.  However, phone traffic is tagged and still will not pass.

Should one of my interfaces on the controller be configured as TRUNK instead of ACCESS?

Also - my windows laptop with Intel NIC strips 801.q from packets so i was unsuccessful at getting a PCAP with that info.  I will continue to try and work on that.

Yes, please configure one of the port on the controller as trunk and match the same configuration on the uplink switch; then retest it.

Thanks!

To be clear - our avaya system is setup and running fine now.  Phones are plugged into our local network.  For that purpose, we are using DHCP option 242 as specified by Avaya.  It works as it should on our local wired network.

This will be a bit confusing :

If i set eth1 to access vlan 350 on the RAP, my laptop will NOT get a DHCP address.  However, if i change the core switch port to UNTAGGED vlan 350, it will give me an IP address in the VOICE vlan (350)

the switch port on the HP is configured like this

interface J4
   name "Aruba Master Voice"
   tagged vlan 350
   untagged vlan 300
   exit

Configure e1 as a trunk and connect the switch to that . You need to also create those VLANs in the switch

Make That the VOICE VLAN already exist on your controller ?

I currently have that same setup with a Cisco phone and it works with no issues.

I guess Voice VLAN 350 already exist on the controller

Voice VLAN does exist on the controller.

Also - these deployments aren't remote office locations, they are users home office.  So it's unfeasible to have a managed switch at each of their houses to make this work.

Definately right about that.

In case you should be able to make the port an access port and it should work with no issues , I also have a similar setup .

Can you please share your configuration ?

Is the phone able to come up directly connected to the controller using that same VLAN ?

Which config would you like me to share, my controller?

Here is something i do not fully understand.

If i putty into my controller, from the controller i CANNOT ping my voice vlan.

If i connect to my SSID with a laptop, from the laptop i CAN ping my voice vlan

Do you have restrictions on your uplink or firewall that only allows certain segment to reach your VOICE segment ?

By that do you mean, on the aruba controller?

The only ACL's on my core switch are to restrict access to my VMWare cluster.  Other than that, wired lan any vlan can ping any vlan.

But let's focus on this:

Since you are able to get an IP while on the SSID , this means that you should able to get it to work on the RAP as well.

You should have something like this :

Let me give you a quick overview -

my network is very flat

Vlan 10 - Servers

Vlan 300 - Clients

Vlan 310 - Guest Wireless

Vlan 350 - Voice

On campus, our AP's broadcast 2 SSID's.  1 for internal users, 1 for guests.  If you connect to the internal, you will get an IP in the 300 vlan and vlan 310 if you connect to guest.

Now - on campus, if i connect to my internal wireless network (and get an IP in the 300 vlan), i can ping anything on the 350 network.

My RAP at home, broadcasts that same internal SSID.  WHen i connect to it at home, again i get an IP in my 300 vlan.  However, from home i cannot PING the 350 network, i can however PING the 10 network from home.

This is how my ETH1 port was configured at first.  Whether DHCP or STATIC settings on the phone, it will not connect to the Avaya IP500.  If DHCP, it will just sit waiting for an address.  IF static, it will sit trying to discover the IP of the system.

---

@mike.robertson wrote:

Let me give you a quick overview -

 

my network is very flat

 

Vlan 10 - Servers

Vlan 300 - Clients

Vlan 310 - Guest Wireless

Vlan 350 - Voice

 

On campus, our AP's broadcast 2 SSID's.  1 for internal users, 1 for guests.  If you connect to the internal, you will get an IP in the 300 vlan and vlan 310 if you connect to guest.

 

Now - on campus, if i connect to my internal wireless network (and get an IP in the 300 vlan), i can ping anything on the 350 network.

 

My RAP at home, broadcasts that same internal SSID.  WHen i connect to it at home, again i get an IP in my 300 vlan.  However, from home i cannot PING the 350 network, i can however PING the 10 network from home.

 

 

---

In this case you need to look at the user-role you get when connect through the RAP and make sure you are allowing this 

Do a show rights <user-role>

But that shouldn't impact you eth1 situation , since it just a attaching to the phone to that VOICE VLAN

I have this "working" to some extent

eth1 config :

tunnel mode

switchport mode access

access mode vlan 350 (voice vlan)

trusted/broadcast boxes checked

controller config

switchport mode access

switchport access vlan 350

core switch config

untagged vlan 350

Strangely - this exact config was NOT working for me originally. 

The only thing i changed to make this work..................on the actual 9611G avaya phone...........i set the 801.q setting to "AUTO".  Rebooted the phone and works wonderfully.

Great news. By default on phone, we should be seeing the setting for 802.1q as "auto" itself. 

Also make sure you wire AP is enabled and it is trusted.