Controllerless Networks

last person joined: an hour ago 

Aruba Instant Wi-Fi: Meet the controllerless Wi-Fi solution that's easy to set-up, is loaded with security and smarts, and won't break your budget.
Expand all | Collapse all

IAP wireless NATing only on master AP

  • 1.  IAP wireless NATing only on master AP

    Posted 13 days ago


    ------------------------------
    Ingo Roschmann
    ------------------------------


  • 2.  RE: IAP wireless NATing only on master AP

    Posted 13 days ago
    When connecting to the secondary IAP, what does the radius server see?  It sounds like you need to enable dynamic radius proxy, which is in the system settings.

    ------------------------------
    Michael Clarke (Aruba)
    ------------------------------



  • 3.  RE: IAP wireless NATing only on master AP

    Posted 13 days ago
    When connection to either master or slave AP, RADIUS authentication takes place and is successful.
    dynamic proxy setting is RADIUS b.t.w.
    Something in the communication between the two APs seems not ok; network or firewall should not be an issue, both APs are on the same LAN segment, same VLAN, no firewall in between.
    At the moment I am in contact with Aruba support, they are analyzing some logs we have recorded this morning. I hope they can work it out.

    Edit:
    Unfortunately no idea from Aruba support so far, they cannot replicate the behaviour in their lab and are suspecting something being wrong on the wired network.
    I just double checked and both, master AP and slave AP are stitting on the same switch, in the same management VLAN (and can ping each other). So I have no idea what to look for on the wired network.

    Any hints appreciated...

    ------------------------------
    Ingo Roschmann
    ------------------------------



  • 4.  RE: IAP wireless NATing only on master AP

    Posted 6 days ago
    The problem is resolved.
    In case of a wireless configuration with IP and VLAN automagically assigned, communication between slave AP and master AP takes place on the magic VLAN 3333, *not* on the AP's management VLAN. Resolution of our problem was to configuring the switch ports of the APs with an untagged VLAN 3333 (making this tagged did not work!).
    We did not test this but maybe all you have to do is to have *any* VLAN untagged on all the AP's switch ports and to make sure this VLAN is being transported through all interconnecting switches, or even simpler: this VLAN being the default VLAN. That being said, maybe you won't have any trouble if all your switches have the default VLAN untagged on all the ports as if they were out of the box. This was not the case on our switches.

    ------------------------------
    Ingo Roschmann
    ------------------------------



  • 5.  RE: IAP wireless NATing only on master AP

    Posted 6 days ago
    I missed your point 'uplink-vlan set'. You now created a kind of mess... NAT will always go out on the untagged (I assumed the management, but it may be the untagged). It is deprecated to set your management vlan, just put your management vlan untagged to all your APs and that is the vlan where your management will happen, and where the NAT is happening for outgoing traffic in the magic vlan.

    By putting vlan 3333 untagged on your APs, you basically just put an untagged VLAN which solved your issue, but the VLAN id is irrelevant.

    Recommended deployment (see also the Aruba Instant VRD):
    - Management network untagged to all of your APs. This is also the VLAN where guest traffic in 'AP Assigned' networks will go out (NAT-ted).
    - Client VLANs tagged to all of your APs. In order to separate your wireless clients from wired clients.

    Management VLAN should only be used when there is no possibility to have the management VLAN untagged, and it will give more complex operations when you need to add/replace APs as they need to be configured with the vlan id before you can add them. With the recommendation, just add the APs and all will work automatically.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
    ------------------------------



  • 6.  RE: IAP wireless NATing only on master AP

    Posted 6 days ago
    Herman,

    thank you very much for the input, I think I understand
    I was pretty sure to having created a mess ...
    will try reconfiguring (unconfigure option uplink-vlan, make management vlan untagged, remove VLAN 3333) when I am on site again and report back.


    ------------------------------
    Ingo Roschmann
    ------------------------------