Controllerless Networks

I’m trying to setup the cluster of 13 IAP-105 to separate AP management traffic from client’s traffic per Aruba recommendations.

Here is the topology we had before with the only vlan 144 – DATA VLAN:

IAP version is 6.4.4.4-4.2.3.2

----------------------------------------

That is the new one:

What have been done:

1. Created new vlan 198 – APVLAN across all L2 deployment
2. Created sub-interface on the gateway assigned to vlan 198 (192.168.198.1)
3. Changed all management IP of each IAP (statically assigned from 192.168.198.11 – 192.168.198.23). VC AP settings have been changed last
4. SSID vlan changed from default value to static - 144 (DATA VLAN)
5. Enet-vlan set to 198
6. Changed settings of VC to new subnet addressing – 192.168.198.10 - VC IP
7. All uplinks to edge switch converted to trunks with allowed vlan 198 (untagged) and vlan 144 (tagged)

Now we have working SSID assigned to DATA VLAN (144). Clients can connect and they are getting IPs from vlan144 DHCP pool.

APVLAN seems to be working too.

The problem is in routing between DATA VLAN and APVLAN. No access from DATA VLAN to APVLAN. Its needed for management purposes as pictured.

Predicting your questions I can answer there is no problem with routing at gateway because new vlan 198 deployment was verified before changing IAP settings. Any laptop connected to APVLAN can access any device in DATA VLAN and wise versa. I noticed some strange things while pinging IAP management IPs from DATA VLAN ping is coming through only when AP is booting up. Right after VC initialized ping stops.

I tried to change uplink management VLAN to 198 which is not recommended but it didn’t help.

Any ideas how VC can mess routing between APVLAN and DATA VLAN?

Please advise!

What version of Instant?

What AP model?

Do you have all of your APs plugged into enet0?

Do you have an ACLs/Rules blocking users that attach to the wireless?

Are your subnet masks correct on your devices?

Hi Colin,

Thanks for prompt reply.

1. Instant ver - 6.4.4.4-4.2.3.2

2. All APs are IAP-105

3. Yes. to the only port available

4. As of right now it is unrestricted. No ACLs no rules (defaults only)

5. Yes. That APVLAN is dedicated for AP management only so the only devices connected directly are all 13 instant APs and GW and the mask is 255.255.255.224 as pictured on my scheme attached to initial post. All descriptions also in intial post.

I have no issues with clients access to corporate vlan - DATA VLAN. Also clients have access to internet which is managed by FW/GW. No issues here.

The issue is in routing from DATA VLAN to APVLAN and wise versa. I can not even access VC management IP to get GUI. No cli either.

Somehow its blocked. At the same time if I connect laptop to APVLAN with statically assigned 192.168.198.2/27 it works perfect it can connect DATA VLAN devices with no problem.

1. Is there specific reason for configuring enet-vlan in the setup?

Usage of enet-vlan:

By default, the value is set to 1. The VLAN setting configured by this command is used for restricting the AP from sending
out tagged frames to clients connected on the SSID that has the same VLAN as the native VLAN of the upstream switch, to which the IAP is connected.

As per the topology, the client vlan is different from the native vlan of upstream switch.

2. Uplink Management vlan.

By default, traffic that is generated by an AP is untagged. The native VLAN of the trunk port that connects the AP must be functional. If the native VLAN of the trunk port to which an IAP is connected is a dummy VLAN, you might have to use a tagged VLAN on the port as the AP VLAN. In such a situation, the AP traffic must be tagged to ensure
that the IAP receives its IP address from the tagged AP VLAN and that all traffic that is generated by the AP is carried on the tagged AP VLAN.

As per the topology , AP's are working on native vlan itself.

Is it possible for you to remove enet-vlan/uplink mgmt vlan paramters & test the reachability to mgmt vlan from wireless clients ?

---

@Nitesh Singla wrote:

1. Is there specific reason for configuring enet-vlan in the setup?

 

 

---

Nitesh,

HP switch that I use as an edge switch for APs has vlan 1 as native vlan. All ports set to forward untagged packets into vlan198 and tagged ones to vlan144.

Last update:

After I changed Management Uplink VLAN on each AP from its default value to 198 I'm able to ping and access VC and preffered master AP from vlan144.

Also I created DHCP scope for 198 vlan on the server in 144 vlan and made reservations for all APs. Now all APs IPs are dhcp-assigned.

I attached 2 files with IAP config and edge switch config.

Attachment(s)

iap-config.txt   4 KB 1 version

WAP-SW-conf.txt   1 KB 1 version

Hi ,

Thank you for the update.

My previous suggestions were based on the following comment which was part of proposed topology:

"AP's connected to trunk ports with AP vlan as native"

But I am glad that the issue has been resolved.

Hi Nitesh,

It's resolved partially because 11 of 13 APs can not be reached from data vlan (144) which is needed for monitoring, snmp, syslog etc.

Like I told if I reload whole cluster at first seconds while APs are booting up I can ping all of them but VC. Once VC takes control over cluster (I can see this by pinging VC) ping to other APs stops.

This is very weird and I couldn't find the issue by now.

UPD:

[Resolved]
1. executed cli command (config)# no enet-vlan

2. Changed uplink management vlan to 0 (default)