Wired clients on RAP's uplink port

[cniessner]

Hi All, i have a small branch office with 3 people setting in 2 rooms. My problem is that i only have one cable from the RAP to the switch - and that's the cause for my question: Is it possible to use the RAP's uplink port as uplink and as a client access port (on a different vlan's, of course!) i.e. the 'untrusted' external network with internet access is on vlan 1 / untagged, and my internal networks are tagged vlan's? i tried to configure the uplink for for this rap like an 'normal' internal port with tagged vlan's, but it doesn't seem to work. Is there an additional trick to get this working on the uplink port or is it not supported? (tried it on 6.2.1.2 on a rap3) Thanks & Bye, Chris

[Victor Fabian]

- Make sure that the VLAN exist on your controller and trunked if it doesn't live there 

- Enable the wired AP and make it trusted if you are not planning to do any authentication on that port

- Add this config to the port you are planning to use

[cniessner]

Dear Victor, it seems i was not clear in my question: What you described is the 'normal' way that's working for me. What i need in this case is to configure the RAP's uplink port ("Ethernet interface 0 port confguration" on your screeshot) to work as 'RAP uplink' to the internet and to provide wired user access on different vlan's (Wired AP enabled, switchport mode trunk, allowed vlan 100, native vlan 1). I hope this setup is possible. Just configuring "Ethernet interface 0 port confguration" as trunk Wired AP port doesn't seam to do the job - i see no vlan-tagged frames coming out of the AP... ;( Thanks & Bye, Chris

[Victor Fabian]

Sorry I am still a little bit confuse on what you are trying to accomplish 

If you have e0 serving as the uplink (Internet) builds ipsec tunnel back to the controller , where is the wired user connected ?

Do you have a switch connected to one of the RAP ports or do you have the user connected directly into the RAP ?

RAP0-------->>>>uplink (you can only use that port you reach the controller)

RAP1-------->>>>You can configure it to handle other traffic like the one you describe

If you are using a switch make sure that you are also setting up VLAN1 as native VLAN on that trunk

[cniessner]

Dear Victor,

Currently I have it working with an additional switch, maybe this way it is more clear:

            =========      =========

            |  Vlan1| ---- | Rap e0|

------------|       |      |       |

  Uplink    |  Vlan5| ---- | Rap e1|

  (Trunk)   =========      =========

My problem is I have only one cable to the ceiling where the RAP stays. So I have to use the same cable for the 'external' side of the RAP (ipsec tunnel) and for the internal side (where the clients connect).

I can use the same vlan id on the controller and on the client side, so it won't be an issue to configure the port as trunk. My initial idea was to configure the E0 port as 'trunk' and have the rap to use untagged/vlan1 as 'external' side and have the 'internal' network as tagged vlan on the same cable. But it didn't work, it seems that the RAP doesn't send me out any tagged traffic on the uplink port.

So I'm currently using the additional switch to consolidate both networks into one wire again. It's not beautiful because I have an additional ugly box hanging on the ceiling next to the Aruba AP but this solution currently works. It would be much smarter if we find a way to use the same port as uplink and for the wired clients on the AP. This would even allow me to use an AP105 as RAP and power it via PoE, so I can also remove the power cords ;)

Thanks & Bye,

      Chris

[Victor Fabian]

This was the key info "AP105 as RAP and power it via PoE" since you don't have any additional ports available on the IAP105, unfortunately you cant use the uplink port e0 in that way as you already found out.