Controllerless Networks

Hello Experts, 

i have 2 site, site A and site B, controller is found on site A, both site are link via an SD-WAN, controller can see AP from both site, but on site B is not getting IP from site b dhcp server, the SSID has vlan 300 enable which is site b user vlan. any idea how to make it works?

Is the WLAN at site B in tunnel or bridge mode?

a bridge

Ok. How are your AP switchports configured? Trunk? Access?

What VLAN is set in your VAP?

What VLAN is set here for site B APs: AP-Group> AP> System Profile> Native VLAN

AP are access type, vlan 300, native vlan 1, the AP IP is on vlan 320 which is ip 192.168.32.1/23

Generally, when you set your VAP to bridge mode you either:
- bridge traffic at your AP untagged
- bridge traffic at your AP tagged

If you want your Wi-Fi traffic to exit your AP untagged (e.g. on the same subnet as your AP) set your VLAN to 1 in your VAP.

If you want your Wi-Fi traffic to exit your AP tagged (e.g. on a different VLAN/subnet as your AP) set your VLAN to 300 in your VAP & configure your switchport your AP is patched into as a trunk port with native VLAN 320 (AP VLAN) & tagged VLAN 300 (Client VLAN).

i set the native vlan to 300, on profiles, I'm getting ip from VLAN 320 which is 192.168.32.1/24 but my SSID is on VLAN 300, the DHCP IP should be 192.168.30.1/24, shall the VLAN on the interface have an IP?, my switch port has default native VLAN 1, I have several VLAN on it, 10 in total, SITE A have VLAN 106 as management VLAN, all AP is on it, on-site A everything works perfectly, each SSID can get ip from their respected VLAN. should I still change the native VLAN of my switch to 300? I have configured only one port for all these VLAN.

If the VLAN set in your VAP matches the VLAN set here: AP-Group> AP> System Profile> Native VLAN then the traffic will exit the AP untagged which sounds like what is happenning.

To fix it do this:
Set this to 1: Sita B AP-Group> AP> System Profile> Native VLAN
Set the VAP VLAN to 300.
Ensure the switchport the AP is patched into is configured as a trunk and VLAN 300 is tagged.

For reference, here's a similar question that was answered: https://community.arubanetworks.com/t5/Wireless-Access/VLAN-configuration-and-bridge-mode/td-p/147352

The VLAN 300 and 320 are

found at site B, on SITE A, core switch should I  tagged VLAN 320 and 300 to the trunk that connects the master controller?

As you've previously said your virtual AP profile for site B is in bridge mode, your site B VLANs don't need to exist at site A.

To fix it do this:
Set this to 1: Sita B AP-Group> AP> System Profile> Native VLAN
Set the VAP VLAN to 300.
Ensure the switchport the AP is patched into is configured as a trunk and VLAN 300 is tagged.

 

When I tried this, I didn't get IP, I must set the profile to native VLAN 300 to get IP from VLAN 320, I'm not understanding, how to make it work on VLAN 300, I must get VLAN 300 IP on the AP when connected to it. VAP is set to VLAN 300. my switch port native VLAN is 1, on-site A everything works perfectly, its only on-site B im getting this issue.

I`m using Aruba OS 8.5

WOuld you share some of your config so I can see how it's currently setup?

On your controller CLI can you run: show wlan virtual-ap <site B VAP name> and post the output?

Also can you post the CLI config of the switchport that your AP at site B is patched into?

(Arubamaster) [mynode] #show wlan virtual-ap "unity warehouse"

Virtual AP profile "Unity Warehouse"
------------------------------------
Parameter Value
--------- -----
AAA Profile Unity Warehouse_aaa_prof
802.11k Profile default
Hotspot 2.0 Profile N/A
Virtual AP enable Enabled
VLAN 300
Forward mode bridge
SSID Profile Unity Warehouse_ssid_prof
Allowed band all
Band Steering Disabled
Cellular handoff assist Disabled
Openflow Enable Enabled
Steering Mode prefer-5ghz
Dynamic Multicast Optimization (DMO) Disabled
Dynamic Multicast Optimization (DMO) Threshold 6
Drop Broadcast and Multicast Disabled
Convert Broadcast ARP requests to unicast Enabled
Authentication Failure Blacklist Time 3600 sec
Blacklist Time 3600 sec
--More-- (q) quit (u) pageup (/) search (n) repeat
Deny inter user traffic Disabled
Deny time range N/A
DoS Prevention Disabled
HA Discovery on-association Enabled
Mobile IP Enabled
Preserve Client VLAN Disabled
Remote-AP Operation standard
Station Blacklisting Enabled
Strict Compliance Disabled
VLAN Mobility Disabled
WAN Operation mode always
FDB Update on Assoc Disabled
WMM Traffic Management Profile N/A
Anyspot profile N/A

 

 

 

interface gigabitethernet 0/0/4
description "MAIN-FIBRE"
trusted
trusted vlan 1-4094
no poe
switchport mode trunk
switchport access vlan 106

native vlan 1

You don't have VLAN 300 trunked to your AP. Add VLAN 300 as an allowed trunk VLAN.

switchport trunk allowed vlan 300

ALso just to check the other settings which could affect things.. Can you check what AP group your site B APs are in?

Then post the following:

show ap-group <site B ap group>
show ap system-profile <profile used in above ap group>

where shall I run this command? : switchport trunk allowed vlan 300 on the interface?

---

@jrwhitehead wrote:
ALso just to check the other settings which could affect things.. Can you check what AP group your site B APs are in?

Then post the following:

show ap-group <site B ap group>
show ap system-profile <profile used in above ap group>

---

 

Arubamaster) [mynode] (config) #show ap-group "JIN FEI"

AP group "JIN FEI"
------------------
Parameter Value
--------- -----
Virtual AP Unity Warehouse
Virtual AP Unity Guest
Virtual AP Radio
802.11a radio profile JIN FEI_radio_a_ui
802.11g radio profile JIN FEI_radio_g_ui
802.11 60GHz radio profile default
Ethernet interface 0 port configuration default
Ethernet interface 1 port configuration default
Ethernet interface 2 port configuration shutdown
Ethernet interface 3 port configuration shutdown
Ethernet interface 4 port configuration shutdown
Ethernet usb port configuration shutdown
AP system profile JIN FEI_apsys_ui
AP multizone profile default
802.11a Traffic Management profile N/A
802.11g Traffic Management profile N/A
Regulatory Domain profile default
RF Optimization profile default
--More-- (q) quit (u) pageup (/) search (n) repeat
RF Event Thresholds profile default
IDS profile default
Mesh Radio profile default
Mesh Cluster profile N/A
WiFi uplink profile N/A
Provisioning profile N/A
AP authorization profile N/A
IoT radio profile N/A

 

(Arubamaster) [mynode] (config) #show ap system-profile "JIN FEI_apsys_ui"

AP system profile "JIN FEI_apsys_ui"
------------------------------------
Parameter Value
--------- -----
RF Band g
Recovery Mode auto
RF Band for AM mode scanning all
Native VLAN ID 300
WIDS AMPDU Optimization Enabled
Tunnel Heartbeat Interval 1
Session ACL ap-uplink-acl
Corporate DNS Domain N/A
SNMP sysContact N/A
LED operating mode (11n/11ac APs only) normal
LED override Disabled
Driver log level warnings
Console log level emergencies
SAP MTU N/A
RAP MTU 1300 bytes
LMS IP 192.168.106.3
Backup LMS IP 192.168.106.4
LMS IPv6 N/A
Backup LMS IPv6 N/A
LMS Preemption Disabled
LMS Hold-down Period 600 sec
LMS ping interval 20
Remote-AP DHCP Server VLAN N/A
Remote-AP DHCP Server Id 192.168.11.1
Remote-AP DHCP Default Router 192.168.11.1
Remote-AP DHCP DNS Server N/A
Remote-AP CORP DNS Server N/A
Remote-AP CORP DNS Server IPV6 N/A
Remote-AP DHCP Pool Start 192.168.11.2
Remote-AP DHCP Pool End 192.168.11.254
Remote-AP DHCP Pool Netmask 255.255.255.0
Remote-AP DHCP Lease Time 0 days
Remote-AP uplink total bandwidth 0 kbps
Remote-AP bw reservation 1 N/A
Remote-AP bw reservation 2 N/A
Remote-AP bw reservation 3 N/A
Remote-AP Local Network Access Disabled
Flex Radio Mode 2.4GHz-and-5GHz
Dual 5GHz Mode Enabled
IPM activation Disabled
IPM power reduction steps with priorities N/A
IPM Steps delete all No
Bootstrap threshold 8
Double Encrypt Disabled
Heartbeat DSCP 0
Management DSCP N/A
IP DSCP to VLAN 802.1p priority mapping N/A
Maintenance Mode Disabled
Maximum Request Retries 10
Request Retry Interval 10 sec
Number of IPSEC retries 85
Secondary Master IP/FQDN N/A
AeroScout RTLS Server N/A
RTLS Server configuration N/A
RTLS Server Compatibility Mode Enabled
SES-imagotag ESL Server IP N/A
SES-imagotag ESL Channel N/A
SES-imagotag ESL Radio Coexistence Enabled
Slow Timer Recovery by rebooting itself Enabled
Telnet Enabled
Disable RAP Tftp Image Upgrade Disabled
Image URL N/A
Spanning Tree Disabled
AP multicast aggregation Enabled
AP ARP attack protection Disabled
AP multicast aggregation allowed VLANs 300,320
Console enable Enabled
AP Console Protection Enabled
AP Console Password ********
Password for Backup ********
AP USB Power mode auto
AP POE mode shared
RF Band for Backup all
Operation for Backup off
BLE Operation Mode Disabled
GRE offload Enabled
Bridge offload Enabled
Health Check Disabled
Health Check Parameter mode ping packet-size 32 burst-size 5 report 60 frequency 10 retries 3
AirMatch Report Period 30 minutes
AirMatch Measurement Duration 5 minutes
AirMatch Report Enabled Enabled
AP Deploy-hour N/A
Dump collection profile default
(Arubamaster) [mynode] (config) #

As you are bridging traffic on your (unity warehouse) virtual AP profile and you want your APs to be on a different VLAN to your clients, you need to trunk your client VLAN (300) to each AP at site B that uses this virtual AP profile.

 

To fix it do this:

1. Set this to 1: Sita B AP-Group> AP> System Profile> Native VLAN
2. Ensure the switchport the AP(s) is patched into is configured as a trunk and VLAN 300 is tagged.

I'm assuming that VLAN 300 existing at SIte B and if a device is placed in VLAN 300, on the switch that you're testing with, it would receive an IP address.

 

 

i have 2 site, site A and site B, controller is found on site A, both site are link via an SD-WAN, controller can see AP from both site, but on site B is not getting IP from site b dhcp server, the SSID has vlan 300 enable which is site b user vlan. any idea how to make it works?

 

I'm confused - even after reading all posts by you and James :D

 

1. This is the IAP forum, but it looks like these AP's are in Campus mode controller by the Controller at Site A.

2. You are saying the sites are connected using SD-WAN. Is this SD-WAN from Aruba or from somewhere else?

 

Regardless - I'm pretty sure James has said whats need to be done.

 

In Bridge mode - root of all that is evil - the AP's doesn't behave like normal.. If you set the VAP in Bridge and Clients are to be placed in VLAN 300 - that traffic will exit the AP with VLAN 300 TAGGED.

Same with VLAN 320. If you do that with BRIDGE and clients set to VLAN 320 - the traffic exiting the AP locally on the switch will be TAGGED vlan 320.

 

So..

VLAN 1 is set to native. This is the VLAN your AP's get their IP address from the local DHCP server.

 

Client VLAN 320 and 300 has to be TAGGED/ALLOW TRUNK on the switch-port IF you bridge these two VAP's.

 

Clients that are supposed to NOT BE BRIDGE - don't need the VLAN on the switchport as this i sendt north through the tunnel to Controller at Site  A.

 

I tried what you asked, still not working traffic is still getting out on VLAN 320, I tested the VLAN 300 switch, I'm able to get DHCP on that VLAN, on my switch where AP is connected, it is untagged on VLAN 320, both VLAN 300 & 320  are trunk on the switch till the firewall. on VLAN 320 I'm able to ping any IP and gateway of VLAN 300.

Can you show me the switchport configuration of the port the AP is patched into?

Also can you show the following?
show ap database | include <ap name you are testing with>
show ap-group <site B ap group>
show wlan virtual-ap "unity warehouse"
show ap system-profile <profile used in above ap group>

(Arubamaster) [mynode] #show ap database

AP Database
-----------
Name Group AP Type IP Address Status Flags Switch IP Standby IP
---- ----- ------- ---------- ------ ----- --------- ----------
7c:57:3c:cb:b5:44 Somatrans 303 192.168.106.150 Down 2 192.168.106.3 0.0.0.0
ACD-01 RICHETERRE 303 192.168.106.131 Down 2 192.168.106.3 0.0.0.0
ACD-02 RICHETERRE 303 192.168.106.132 Down 2 192.168.106.3 0.0.0.0
ACD-03 RICHETERRE 303 192.168.106.133 Down 2 192.168.106.3 0.0.0.0
ACD-04 RICHETERRE 303 192.168.106.134 Down 2 192.168.106.3 0.0.0.0
DR-01 RICHETERRE 303 192.168.106.147 Down 2 192.168.106.3 0.0.0.0
DR-02 RICHETERRE 303 192.168.106.148 Down 2 192.168.106.3 0.0.0.0
DR-03 RICHETERRE 303 192.168.106.149 Down 2 192.168.106.3 0.0.0.0
DR-04 RICHETERRE 303 192.168.106.150 Down 2 192.168.106.3 0.0.0.0
DR-05 default 303 192.168.106.151 Down 2 192.168.106.3 0.0.0.0
DR-06 RICHETERRE 303 192.168.106.152 Down 2 192.168.106.3 0.0.0.0
DR-07 RICHETERRE 303 192.168.106.153 Down 2 192.168.106.3 0.0.0.0
DR-08 RICHETERRE 303 192.168.106.154 Down 2 192.168.106.3 0.0.0.0
DR-09 RICHETERRE 303 192.168.106.155 Down 2 192.168.106.3 0.0.0.0
DR-10 RICHETERRE 303 192.168.106.156 Down 2 192.168.106.3 0.0.0.0
DR-11 default 303 192.168.106.157 Down 2 192.168.106.3 0.0.0.0
DR-12 RICHETERRE 303 192.168.106.158 Down 2 192.168.106.3 0.0.0.0
DR-13 RICHETERRE 303 192.168.106.159 Down 2 192.168.106.3 0.0.0.0
DR-14 RICHETERRE 303 192.168.106.160 Down 2 192.168.106.3 0.0.0.0
DR-15 RICHETERRE 303 192.168.106.161 Down 2 192.168.106.3 0.0.0.0
DR-16 RICHETERRE 303 192.168.106.162 Down 2 192.168.106.3 0.0.0.0
DR-17 RICHETERRE 303 192.168.106.163 Down 2 192.168.106.3 0.0.0.0
DR-18 RICHETERRE 365 192.168.106.164 Down 2 192.168.106.3 0.0.0.0
DR-19 RICHETERRE 365 192.168.106.165 Down 2 192.168.106.3 0.0.0.0
DR-20 RICHETERRE 365 192.168.106.166 Down 2 192.168.106.3 0.0.0.0
DR-21 RICHETERRE 365 192.168.106.167 Down 2 192.168.106.3 0.0.0.0
JF-O-1 JIN FEI 303 192.168.32.47 Up 1d:23h:23m:17s 2 192.168.106.3 192.168.106.4
JF-O-2 JIN FEI 303 192.168.32.48 Up 1d:8h:11m:21s 2 192.168.106.3 192.168.106.4
JF-WH-01 JIN FEI 365 192.168.32.20 Up 1d:8h:11m:21s 2 192.168.106.3 192.168.106.4
JF-WH-02 JIN FEI 365 192.168.32.21 Up 1d:8h:11m:21s 2 192.168.106.3 192.168.106.4
JF-WH-03 JIN FEI 365 192.168.32.22 Down 2 172.16.0.254 0.0.0.0
JF-WH-04 JIN FEI 365 192.168.32.23 Up 1d:8h:11m:21s 2 192.168.106.3 192.168.106.4

Flags: 1 = 802.1x authenticated AP use EAP-PEAP; 1+ = 802.1x use EST; 1- = 802.1x use factory cert; 2 = Using IKE version 2
B = Built-in AP; C = Cellular RAP; D = Dirty or no config
E = Regulatory Domain Mismatch; F = AP failed 802.1x authentication
G = No such group; I = Inactive; J = USB cert at AP; L = Unlicensed
M = Mesh node
N = Duplicate name; P = PPPoe AP; R = Remote AP; R- = Remote AP requires Auth;
S = Standby-mode AP; U = Unprovisioned; X = Maintenance Mode
Y = Mesh Recovery
c = CERT-based RAP; e = Custom EST cert; f = No Spectrum FFT support
i = Indoor; o = Outdoor; s = LACP striping; u = Custom-Cert RAP; z = Datazone AP
p = In deep-sleep status
4 = WiFi Uplink

AP Database
-----------
Name Group AP Type IP Address Status Flags Switch IP Standby IP
---- ----- ------- ---------- ------ ----- --------- ----------
JF-WH-05 JIN FEI 365 192.168.32.24 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-06 JIN FEI 365 192.168.32.25 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-07 JIN FEI 365 192.168.32.26 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-08 JIN FEI 365 192.168.32.27 Up 1d:8h:11m:22s 2 192.168.106.3 192.168.106.4
JF-WH-09 JIN FEI 365 192.168.32.28 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-10 JIN FEI 365 192.168.32.29 Up 20h:36m:41s 2 192.168.106.3 192.168.106.4
JF-WH-11 JIN FEI 365 192.168.32.30 Up 1d:8h:11m:21s 2 192.168.106.3 192.168.106.4
JF-WH-12 JIN FEI 365 192.168.32.31 Up 20h:36m:45s 2 192.168.106.3 192.168.106.4
JF-WH-13 JIN FEI 365 192.168.32.32 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-14 JIN FEI 365 192.168.32.33 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-15 JIN FEI 365 192.168.32.34 Up 1d:8h:11m:24s 2 192.168.106.3 192.168.106.4
JF-WH-16 JIN FEI 365 192.168.32.35 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-17 JIN FEI 365 192.168.32.36 Up 1d:8h:11m:22s 2 192.168.106.3 192.168.106.4
JF-WH-18 JIN FEI 365 192.168.32.37 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-19 JIN FEI 365 192.168.32.38 Up 1d:8h:11m:24s 2 192.168.106.3 192.168.106.4
JF-WH-20 JIN FEI 365 192.168.32.39 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-21 JIN FEI 365 192.168.32.40 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-22 JIN FEI 365 192.168.32.41 Up 1d:8h:11m:22s 2 192.168.106.3 192.168.106.4
JF-WH-23 JIN FEI 365 192.168.32.42 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-24 JIN FEI 365 192.168.32.43 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-25 JIN FEI 365 192.168.32.44 Up 1d:8h:11m:23s 2 192.168.106.3 192.168.106.4
JF-WH-26 JIN FEI 365 192.168.32.45 Up 1d:8h:11m:22s 2 192.168.106.3 192.168.106.4
JF-WH-27 JIN FEI 365 192.168.32.46 Up 1d:8h:11m:24s 2 192.168.106.3 192.168.106.4
JIN-TEST JIN FEI 303 1.1.1.17 Down Rc2 192.168.106.3 0.0.0.0
NW-A-01 RICHETERRE 303 192.168.106.89 Up 12d:22h:0m:18s 2 192.168.106.3 192.168.106.4
NW-A-02 RICHETERRE 303 192.168.106.90 Up 12d:22h:1m:34s 2 192.168.106.3 192.168.106.4
NW-A-03 RICHETERRE 303 192.168.106.91 Up 12d:22h:1m:10s 2 192.168.106.3 192.168.106.4
NW-A-04 RICHETERRE 303 192.168.106.92 Up 5d:15h:30m:35s 2 192.168.106.3 192.168.106.4
NW-A-05 RICHETERRE 303 192.168.106.93 Up 12d:22h:2m:2s 2 192.168.106.3 192.168.106.4
NW-A-06 RICHETERRE 303 192.168.106.94 Up 1d:21h:22m:31s 2 192.168.106.3 192.168.106.4
NW-A-07 RICHETERRE 303 192.168.106.95 Up 12d:22h:1m:27s 2 192.168.106.3 192.168.106.4
NW-A-08 RICHETERRE 303 192.168.106.96 Up 12d:22h:1m:38s 2 192.168.106.3 192.168.106.4

Flags: 1 = 802.1x authenticated AP use EAP-PEAP; 1+ = 802.1x use EST; 1- = 802.1x use factory cert; 2 = Using IKE version 2
B = Built-in AP; C = Cellular RAP; D = Dirty or no config
E = Regulatory Domain Mismatch; F = AP failed 802.1x authentication
G = No such group; I = Inactive; J = USB cert at AP; L = Unlicensed
M = Mesh node
N = Duplicate name; P = PPPoe AP; R = Remote AP; R- = Remote AP requires Auth;
S = Standby-mode AP; U = Unprovisioned; X = Maintenance Mode
Y = Mesh Recovery
c = CERT-based RAP; e = Custom EST cert; f = No Spectrum FFT support
i = Indoor; o = Outdoor; s = LACP striping; u = Custom-Cert RAP; z = Datazone AP
p = In deep-sleep status
4 = WiFi Uplink

AP Database
-----------
Name Group AP Type IP Address Status Flags Switch IP Standby IP
---- ----- ------- ---------- ------ ----- --------- ----------
NW-A-09 RICHETERRE 303 192.168.106.97 Up 12d:22h:3m:42s 2 192.168.106.3 192.168.106.4
NW-A-10 RICHETERRE 303 192.168.106.98 Up 12d:22h:3m:0s 2 192.168.106.3 192.168.106.4
NW-A-11 RICHETERRE 303 192.168.106.99 Up 12d:22h:2m:26s 2 192.168.106.3 192.168.106.4
NW-A-12 RICHETERRE 303 192.168.106.100 Up 12d:22h:23m:31s 2 192.168.106.3 192.168.106.4
NW-A-13 RICHETERRE 303 192.168.106.101 Up 1d:18h:24m:6s 2 192.168.106.3 192.168.106.4
NW-A-14 RICHETERRE 303 192.168.106.102 Up 5d:20h:44m:53s 2 192.168.106.3 192.168.106.4
NW-A-15 RICHETERRE 303 192.168.106.103 Up 12d:22h:0m:48s 2 192.168.106.3 192.168.106.4
NW-A-16 RICHETERRE 303 192.168.106.104 Up 12d:22h:19m:50s 2 192.168.106.3 192.168.106.4
NW-A-17 RICHETERRE 303 192.168.106.105 Up 12d:22h:19m:10s 2 192.168.106.3 192.168.106.4
NW-A-18 RICHETERRE 303 192.168.106.106 Up 1d:17h:22m:41s 2 192.168.106.3 192.168.106.4
NW-A-19 RICHETERRE 303 192.168.106.107 Down 2 192.168.106.3 0.0.0.0
NW-B-01 RICHETERRE 303 192.168.106.108 Up 12d:22h:30m:4s 2 192.168.106.3 192.168.106.4
NW-B-02 RICHETERRE 303 192.168.106.109 Up 12d:22h:31m:0s 2 192.168.106.3 192.168.106.4
NW-B-03 RICHETERRE 303 192.168.106.110 Up 1d:18h:24m:9s 2 192.168.106.3 192.168.106.4
NW-B-04 RICHETERRE 303 192.168.106.111 Up 1d:18h:24m:8s 2 192.168.106.3 192.168.106.4
NW-B-05 RICHETERRE 303 192.168.106.112 Up 12d:22h:29m:32s 2 192.168.106.3 192.168.106.4
NW-B-06 RICHETERRE 303 192.168.106.113 Up 12d:22h:30m:11s 2 192.168.106.3 192.168.106.4
NW-B-07 RICHETERRE 303 192.168.106.114 Up 12d:22h:29m:34s 2 192.168.106.3 192.168.106.4
NW-B-08 RICHETERRE 303 192.168.106.115 Up 12d:22h:27m:43s 2 192.168.106.3 192.168.106.4
NW-B-09 RICHETERRE 303 192.168.106.116 Up 12d:22h:30m:47s 2 192.168.106.3 192.168.106.4
NW-B-10 RICHETERRE 303 192.168.106.117 Up 12d:22h:28m:24s 2 192.168.106.3 192.168.106.4
NW-B-11 RICHETERRE 303 192.168.106.118 Up 12d:22h:28m:32s 2 192.168.106.3 192.168.106.4
NW-B-12 RICHETERRE 303 192.168.106.119 Up 12d:22h:30m:55s 2 192.168.106.3 192.168.106.4
NW-C-1 RICHETERRE 303 192.168.106.120 Up 12d:22h:29m:37s 2 192.168.106.3 192.168.106.4
NW-C-10 RICHETERRE 303 192.168.106.129 Up 12d:22h:27m:56s 2 192.168.106.3 192.168.106.4
NW-C-11 RICHETERRE 303 192.168.106.130 Up 11d:20h:41m:48s 2 192.168.106.3 192.168.106.4
NW-C-2 RICHETERRE 303 192.168.106.121 Up 1d:18h:24m:7s 2 192.168.106.3 192.168.106.4
NW-C-3 RICHETERRE 303 192.168.106.122 Up 12d:22h:29m:27s 2 192.168.106.3 192.168.106.4
NW-C-4 RICHETERRE 303 192.168.106.123 Up 12d:22h:29m:7s 2 192.168.106.3 192.168.106.4
NW-C-5 RICHETERRE 303 192.168.106.124 Up 12d:22h:27m:28s 2 192.168.106.3 192.168.106.4
NW-C-6 RICHETERRE 303 192.168.106.125 Up 1d:22h:43m:20s 2 192.168.106.3 192.168.106.4
NW-C-7 RICHETERRE 303 192.168.106.126 Up 1d:18h:24m:8s 2 192.168.106.3 192.168.106.4

Flags: 1 = 802.1x authenticated AP use EAP-PEAP; 1+ = 802.1x use EST; 1- = 802.1x use factory cert; 2 = Using IKE version 2
B = Built-in AP; C = Cellular RAP; D = Dirty or no config
E = Regulatory Domain Mismatch; F = AP failed 802.1x authentication
G = No such group; I = Inactive; J = USB cert at AP; L = Unlicensed
M = Mesh node
N = Duplicate name; P = PPPoe AP; R = Remote AP; R- = Remote AP requires Auth;
S = Standby-mode AP; U = Unprovisioned; X = Maintenance Mode
Y = Mesh Recovery
c = CERT-based RAP; e = Custom EST cert; f = No Spectrum FFT support
i = Indoor; o = Outdoor; s = LACP striping; u = Custom-Cert RAP; z = Datazone AP
p = In deep-sleep status
4 = WiFi Uplink

AP Database
-----------
Name Group AP Type IP Address Status Flags Switch IP Standby IP
---- ----- ------- ---------- ------ ----- --------- ----------
NW-C-8 RICHETERRE 303 192.168.106.127 Up 1d:18h:24m:7s 2 192.168.106.3 192.168.106.4
NW-C-9 RICHETERRE 303 192.168.106.128 Up 12d:22h:28m:19s 2 192.168.106.3 192.168.106.4
OGF-01 RICHETERRE 303 192.168.106.135 Down 2 192.168.106.3 0.0.0.0
OGF-02 RICHETERRE 303 192.168.106.136 Down 2 192.168.106.3 0.0.0.0
OGF-03 RICHETERRE 303 192.168.106.137 Down 2 192.168.106.3 0.0.0.0
OGF-04 RICHETERRE 303 192.168.106.138 Down 2 192.168.106.3 0.0.0.0
OGF-05 RICHETERRE 303 192.168.106.139 Down 2 192.168.106.3 0.0.0.0
OGF-06 RICHETERRE 303 192.168.106.140 Down 2 192.168.106.3 0.0.0.0
OTF-01 RICHETERRE 303 192.168.106.141 Down 2 192.168.106.3 0.0.0.0
OTF-02 RICHETERRE 303 192.168.106.142 Down 2 192.168.106.3 0.0.0.0
OTF-03 RICHETERRE 303 192.168.106.143 Down 2 192.168.106.3 0.0.0.0
OTF-04 RICHETERRE 303 192.168.106.144 Down 2 192.168.106.3 0.0.0.0
OTF-05 RICHETERRE 303 192.168.106.145 Down 2 192.168.106.3 0.0.0.0
OTF-06 RICHETERRE 303 192.168.106.146 Down 2 192.168.106.3 0.0.0.0
OW-A-01 RICHETERRE 303 192.168.106.20 Up 11d:23h:43m:42s 2 192.168.106.3 192.168.106.4
OW-A-02 RICHETERRE 303 192.168.106.21 Up 1d:17h:26m:42s 2 192.168.106.3 192.168.106.4
OW-A-03 RICHETERRE 303 192.168.106.22 Up 11d:23h:42m:42s 2 192.168.106.3 192.168.106.4
OW-A-04 RICHETERRE 303 192.168.106.23 Up 11d:23h:42m:10s 2 192.168.106.3 192.168.106.4
OW-A-05 RICHETERRE 303 192.168.106.24 Up 11d:23h:41m:34s 2 192.168.106.3 192.168.106.4
OW-A-06 RICHETERRE 303 192.168.106.25 Up 11d:23h:41m:0s 2 192.168.106.3 192.168.106.4
OW-A-07 RICHETERRE 303 192.168.106.26 Up 11d:23h:40m:28s 2 192.168.106.3 192.168.106.4
OW-A-08 RICHETERRE 303 192.168.106.27 Up 11d:23h:40m:3s 2 192.168.106.3 192.168.106.4
OW-A-09 RICHETERRE 303 192.168.106.28 Up 11d:23h:39m:45s 2 192.168.106.3 192.168.106.4
OW-A-10 RICHETERRE 303 192.168.106.29 Up 11d:23h:39m:30s 2 192.168.106.3 192.168.106.4
OW-A-11 RICHETERRE 303 192.168.106.30 Up 11d:23h:38m:58s 2 192.168.106.3 192.168.106.4
OW-A-12 RICHETERRE 303 192.168.106.31 Up 11d:23h:38m:47s 2 192.168.106.3 192.168.106.4
OW-A-13 RICHETERRE 303 192.168.106.32 Up 1d:23h:33m:55s 2 192.168.106.3 192.168.106.4
OW-A-14 RICHETERRE 303 192.168.106.33 Up 11d:23h:38m:32s 2 192.168.106.3 192.168.106.4
OW-A-15 RICHETERRE 303 192.168.106.34 Up 11d:23h:38m:20s 2 192.168.106.3 192.168.106.4
OW-A-16 RICHETERRE 303 192.168.106.35 Up 11d:23h:38m:14s 2 192.168.106.3 192.168.106.4
OW-A-17 RICHETERRE 303 192.168.106.36 Up 11d:23h:38m:7s 2 192.168.106.3 192.168.106.4
OW-A-18 RICHETERRE 303 192.168.106.37 Up 11d:23h:37m:52s 2 192.168.106.3 192.168.106.4

Flags: 1 = 802.1x authenticated AP use EAP-PEAP; 1+ = 802.1x use EST; 1- = 802.1x use factory cert; 2 = Using IKE version 2
B = Built-in AP; C = Cellular RAP; D = Dirty or no config
E = Regulatory Domain Mismatch; F = AP failed 802.1x authentication
G = No such group; I = Inactive; J = USB cert at AP; L = Unlicensed
M = Mesh node
N = Duplicate name; P = PPPoe AP; R = Remote AP; R- = Remote AP requires Auth;
S = Standby-mode AP; U = Unprovisioned; X = Maintenance Mode
Y = Mesh Recovery
c = CERT-based RAP; e = Custom EST cert; f = No Spectrum FFT support
i = Indoor; o = Outdoor; s = LACP striping; u = Custom-Cert RAP; z = Datazone AP
p = In deep-sleep status
4 = WiFi Uplink

AP Database
-----------
Name Group AP Type IP Address Status Flags Switch IP Standby IP
---- ----- ------- ---------- ------ ----- --------- ----------
OW-A-19 RICHETERRE 303 192.168.106.38 Up 11d:23h:38m:0s 2 192.168.106.3 192.168.106.4
OW-A-20 RICHETERRE 303 192.168.106.39 Up 11d:23h:37m:46s 2 192.168.106.3 192.168.106.4
OW-A-21 RICHETERRE 303 192.168.106.40 Up 1d:18h:42m:6s 2 192.168.106.3 192.168.106.4
OW-B-01 RICHETERRE 303 192.168.106.41 Up 11d:23h:42m:59s 2 192.168.106.3 192.168.106.4
OW-B-02 RICHETERRE 303 192.168.106.42 Up 1d:23h:12m:48s 2 192.168.106.3 192.168.106.4
OW-B-03 RICHETERRE 303 192.168.106.43 Up 1d:21h:23m:16s 2 192.168.106.3 192.168.106.4
OW-B-04 RICHETERRE 303 192.168.106.44 Up 11d:23h:42m:17s 2 192.168.106.3 192.168.106.4
OW-B-05 RICHETERRE 303 192.168.106.45 Up 1d:19h:37m:57s 2 192.168.106.3 192.168.106.4
OW-B-06 RICHETERRE 303 192.168.106.46 Up 11d:23h:41m:48s 2 192.168.106.3 192.168.106.4
OW-B-07 RICHETERRE 303 192.168.106.47 Up 11d:23h:41m:30s 2 192.168.106.3 192.168.106.4
OW-B-08 RICHETERRE 303 192.168.106.48 Up 11d:23h:41m:16s 2 192.168.106.3 192.168.106.4
OW-B-09 RICHETERRE 303 192.168.106.49 Up 11d:23h:49m:10s 2 192.168.106.3 192.168.106.4
OW-B-10 RICHETERRE 303 192.168.106.50 Up 18d:23h:26m:58s 2 192.168.106.3 192.168.106.4
OW-B-11 RICHETERRE 303 192.168.106.51 Up 18d:23h:26m:7s 2 192.168.106.3 192.168.106.4
OW-B-12 RICHETERRE 303 192.168.106.52 Up 11d:23h:38m:36s 2 192.168.106.3 192.168.106.4
OW-B-13 RICHETERRE 303 192.168.106.53 Up 18d:21h:23m:2s 2 192.168.106.3 192.168.106.4
OW-B-14 RICHETERRE 303 192.168.106.54 Up 18d:22h:7m:28s 2 192.168.106.3 192.168.106.4
OW-B-15 RICHETERRE 303 192.168.106.55 Up 11d:20h:38m:24s 2 192.168.106.3 192.168.106.4
OW-B-16 RICHETERRE 303 192.168.106.56 Up 1d:19h:4m:22s 2 192.168.106.3 192.168.106.4
OW-B-17 RICHETERRE 303 192.168.106.57 Up 18d:23h:25m:40s 2 192.168.106.3 192.168.106.4
OW-C-01 RICHETERRE 303 192.168.106.58 Up 18d:23h:38m:25s 2 192.168.106.3 192.168.106.4
OW-C-02 RICHETERRE 303 192.168.106.59 Up 18d:23h:38m:41s 2 192.168.106.3 192.168.106.4
OW-C-03 RICHETERRE 303 192.168.106.60 Up 1d:23h:27m:17s 2 192.168.106.3 192.168.106.4
OW-C-04 RICHETERRE 303 192.168.106.61 Up 18d:23h:40m:33s 2 192.168.106.3 192.168.106.4
OW-C-05 RICHETERRE 303 192.168.106.62 Up 18d:23h:40m:37s 2 192.168.106.3 192.168.106.4
OW-C-06 RICHETERRE 303 192.168.106.63 Up 1d:18h:43m:36s 2 192.168.106.3 192.168.106.4
OW-C-07 RICHETERRE 303 192.168.106.64 Up 18d:23h:41m:7s 2 192.168.106.3 192.168.106.4
OW-C-08 RICHETERRE 303 192.168.106.65 Up 18d:23h:37m:43s 2 192.168.106.3 192.168.106.4
OW-C-09 RICHETERRE 303 192.168.106.66 Up 18d:23h:38m:54s 2 192.168.106.3 192.168.106.4
OW-C-10 RICHETERRE 303 192.168.106.67 Up 18d:23h:37m:46s 2 192.168.106.3 192.168.106.4
OW-C-11 RICHETERRE 303 192.168.106.68 Up 18d:23h:38m:57s 2 192.168.106.3 192.168.106.4
OW-C-12 RICHETERRE 303 192.168.106.69 Up 18d:23h:40m:41s 2 192.168.106.3 192.168.106.4

Flags: 1 = 802.1x authenticated AP use EAP-PEAP; 1+ = 802.1x use EST; 1- = 802.1x use factory cert; 2 = Using IKE version 2
B = Built-in AP; C = Cellular RAP; D = Dirty or no config
E = Regulatory Domain Mismatch; F = AP failed 802.1x authentication
G = No such group; I = Inactive; J = USB cert at AP; L = Unlicensed
M = Mesh node
N = Duplicate name; P = PPPoe AP; R = Remote AP; R- = Remote AP requires Auth;
S = Standby-mode AP; U = Unprovisioned; X = Maintenance Mode
Y = Mesh Recovery
c = CERT-based RAP; e = Custom EST cert; f = No Spectrum FFT support
i = Indoor; o = Outdoor; s = LACP striping; u = Custom-Cert RAP; z = Datazone AP
p = In deep-sleep status
4 = WiFi Uplink

AP Database
-----------
Name Group AP Type IP Address Status Flags Switch IP Standby IP
---- ----- ------- ---------- ------ ----- --------- ----------
OW-C-13 RICHETERRE 303 192.168.106.70 Up 1d:18h:41m:9s 2 192.168.106.3 192.168.106.4
OW-C-14 RICHETERRE 303 192.168.106.71 Up 18d:23h:39m:9s 2 192.168.106.3 192.168.106.4
OW-C-15 RICHETERRE 303 192.168.106.72 Up 1d:18h:41m:8s 2 192.168.106.3 192.168.106.4
OW-C-16 RICHETERRE 303 192.168.106.73 Up 18d:23h:37m:40s 2 192.168.106.3 192.168.106.4
OW-D-01 RICHETERRE 303 192.168.106.74 Up 12d:0h:18m:27s 2 192.168.106.3 192.168.106.4
OW-D-02 RICHETERRE 303 192.168.106.75 Up 12d:0h:18m:0s 2 192.168.106.3 192.168.106.4
OW-D-03 RICHETERRE 303 192.168.106.76 Up 12d:0h:15m:46s 2 192.168.106.3 192.168.106.4
OW-D-04 RICHETERRE 303 192.168.106.77 Up 12d:0h:15m:17s 2 192.168.106.3 192.168.106.4
OW-D-05 RICHETERRE 303 192.168.106.78 Up 12d:0h:14m:23s 2 192.168.106.3 192.168.106.4
OW-D-06 RICHETERRE 303 192.168.106.79 Up 12d:0h:13m:46s 2 192.168.106.3 192.168.106.4
OW-D-07 RICHETERRE 303 192.168.106.80 Up 12d:0h:13m:19s 2 192.168.106.3 192.168.106.4
OW-D-08 RICHETERRE 303 192.168.106.81 Up 12d:0h:12m:59s 2 192.168.106.3 192.168.106.4
OW-D-09 RICHETERRE 303 192.168.106.82 Up 12d:0h:12m:29s 2 192.168.106.3 192.168.106.4
OW-D-10 RICHETERRE 303 192.168.106.83 Up 12d:0h:11m:55s 2 192.168.106.3 192.168.106.4
OW-D-11 RICHETERRE 303 192.168.106.84 Up 12d:0h:11m:29s 2 192.168.106.3 192.168.106.4
OW-D-12 RICHETERRE 303 192.168.106.85 Up 12d:0h:11m:6s 2 192.168.106.3 192.168.106.4
OW-D-13 RICHETERRE 303 192.168.106.86 Up 12d:0h:10m:47s 2 192.168.106.3 192.168.106.4
OW-D-14 RICHETERRE 303 192.168.106.87 Up 1d:18h:32m:10s 2 192.168.106.3 192.168.106.4
OW-D-15 RICHETERRE 303 192.168.106.88 Up 1d:18h:32m:11s 2 192.168.106.3 192.168.106.4

Flags: 1 = 802.1x authenticated AP use EAP-PEAP; 1+ = 802.1x use EST; 1- = 802.1x use factory cert; 2 = Using IKE version 2
B = Built-in AP; C = Cellular RAP; D = Dirty or no config
E = Regulatory Domain Mismatch; F = AP failed 802.1x authentication
G = No such group; I = Inactive; J = USB cert at AP; L = Unlicensed
M = Mesh node
N = Duplicate name; P = PPPoe AP; R = Remote AP; R- = Remote AP requires Auth;
S = Standby-mode AP; U = Unprovisioned; X = Maintenance Mode
Y = Mesh Recovery
c = CERT-based RAP; e = Custom EST cert; f = No Spectrum FFT support
i = Indoor; o = Outdoor; s = LACP striping; u = Custom-Cert RAP; z = Datazone AP
p = In deep-sleep status
4 = WiFi Uplink

Total APs:179
(Arubamaster) [mynode] #

 

Arubamaster) [mynode] #show ap-group "JIN FEI"

AP group "JIN FEI"
------------------
Parameter Value
--------- -----
Virtual AP Unity Warehouse
Virtual AP Unity Guest
Virtual AP Radio
802.11a radio profile JIN FEI_radio_a_ui
802.11g radio profile JIN FEI_radio_g_ui
802.11 60GHz radio profile default
Ethernet interface 0 port configuration default
Ethernet interface 1 port configuration default
Ethernet interface 2 port configuration shutdown
Ethernet interface 3 port configuration shutdown
Ethernet interface 4 port configuration shutdown
Ethernet usb port configuration shutdown
AP system profile JIN FEI_apsys_ui
AP multizone profile default
802.11a Traffic Management profile N/A
802.11g Traffic Management profile N/A
Regulatory Domain profile default
RF Optimization profile default
RF Event Thresholds profile default
IDS profile default
Mesh Radio profile default
Mesh Cluster profile N/A
WiFi uplink profile N/A
Provisioning profile N/A
AP authorization profile N/A
IoT radio profile N/A
(Arubamaster) [mynode] #

 

(Arubamaster) [mynode] #show wlan virtual-ap "unity warehouse"

Virtual AP profile "Unity Warehouse"
------------------------------------
Parameter Value
--------- -----
AAA Profile Unity Warehouse_aaa_prof
802.11k Profile default
Hotspot 2.0 Profile N/A
Virtual AP enable Enabled
VLAN 300
Forward mode bridge
SSID Profile Unity Warehouse_ssid_prof
Allowed band all
Band Steering Disabled
Cellular handoff assist Disabled
Openflow Enable Enabled
Steering Mode prefer-5ghz
Dynamic Multicast Optimization (DMO) Disabled
Dynamic Multicast Optimization (DMO) Threshold 6
Drop Broadcast and Multicast Disabled
Convert Broadcast ARP requests to unicast Enabled
Authentication Failure Blacklist Time 3600 sec
Blacklist Time 3600 sec
Deny inter user traffic Disabled
Deny time range N/A
DoS Prevention Disabled
HA Discovery on-association Enabled
Mobile IP Enabled
Preserve Client VLAN Disabled
Remote-AP Operation standard
Station Blacklisting Enabled
Strict Compliance Disabled
VLAN Mobility Disabled
WAN Operation mode always
FDB Update on Assoc Disabled
WMM Traffic Management Profile N/A
Anyspot profile N/A
(Arubamaster) [mynode] #

 

(Arubamaster) [mynode] #show ap system-profile "JIN FEI_apsys_ui"

AP system profile "JIN FEI_apsys_ui"
------------------------------------
Parameter Value
--------- -----
RF Band g
Recovery Mode auto
RF Band for AM mode scanning all
Native VLAN ID 300
WIDS AMPDU Optimization Enabled
Tunnel Heartbeat Interval 1
Session ACL ap-uplink-acl
Corporate DNS Domain N/A
SNMP sysContact N/A
LED operating mode (11n/11ac APs only) normal
LED override Disabled
Driver log level warnings
Console log level emergencies
SAP MTU N/A
RAP MTU 1300 bytes
LMS IP 192.168.106.3
Backup LMS IP 192.168.106.4
LMS IPv6 N/A
Backup LMS IPv6 N/A
LMS Preemption Disabled
LMS Hold-down Period 600 sec
LMS ping interval 20
Remote-AP DHCP Server VLAN N/A
Remote-AP DHCP Server Id 192.168.11.1
Remote-AP DHCP Default Router 192.168.11.1
Remote-AP DHCP DNS Server N/A
Remote-AP CORP DNS Server N/A
Remote-AP CORP DNS Server IPV6 N/A
Remote-AP DHCP Pool Start 192.168.11.2
Remote-AP DHCP Pool End 192.168.11.254
Remote-AP DHCP Pool Netmask 255.255.255.0
Remote-AP DHCP Lease Time 0 days
Remote-AP uplink total bandwidth 0 kbps
Remote-AP bw reservation 1 N/A
Remote-AP bw reservation 2 N/A
Remote-AP bw reservation 3 N/A
Remote-AP Local Network Access Disabled
Flex Radio Mode 2.4GHz-and-5GHz
Dual 5GHz Mode Enabled
IPM activation Disabled
IPM power reduction steps with priorities N/A
IPM Steps delete all No
Bootstrap threshold 8
Double Encrypt Disabled
Heartbeat DSCP 0
Management DSCP N/A
IP DSCP to VLAN 802.1p priority mapping N/A
Maintenance Mode Disabled
Maximum Request Retries 10
Request Retry Interval 10 sec
Number of IPSEC retries 85
Secondary Master IP/FQDN N/A
AeroScout RTLS Server N/A
RTLS Server configuration N/A
RTLS Server Compatibility Mode Enabled
SES-imagotag ESL Server IP N/A
SES-imagotag ESL Channel N/A
SES-imagotag ESL Radio Coexistence Enabled
Slow Timer Recovery by rebooting itself Enabled
Telnet Enabled
Disable RAP Tftp Image Upgrade Disabled
Image URL N/A
Spanning Tree Disabled
AP multicast aggregation Disabled
AP ARP attack protection Disabled
AP multicast aggregation allowed VLANs 300
Console enable Enabled
AP Console Protection Enabled
AP Console Password ********
Password for Backup ********
AP USB Power mode auto
AP POE mode shared
RF Band for Backup all
Operation for Backup off
BLE Operation Mode Disabled
GRE offload Enabled
Bridge offload Enabled
Health Check Disabled
Health Check Parameter mode ping packet-size 32 burst-size 5 report 60 frequency 10 retries 3
AirMatch Report Period 30 minutes
AirMatch Measurement Duration 5 minutes
AirMatch Report Enabled Enabled
AP Deploy-hour N/A
Dump collection profile default
(Arubamaster) [mynode] #

 

 

what is the command to show switch port config?

show run interface 1 if on Aruba Switch, more or less the same on Cisco i believe

interface gigabitethernet 0/0/4
description "MAIN-FIBRE"
trusted
trusted VLAN 1-4094
no Poe
switchport mode trunk
switchport access VLAN 106
switchport trunk allowed VLAN 1,96-98,106-108,300,320,310

The VLAN in the ap system profile should be 1.

(Arubamaster) [mynode] #show ap system-profile "JIN FEI_apsys_ui"

AP system profile "JIN FEI_apsys_ui"
------------------------------------
Parameter Value
--------- -----
RF Band g
Recovery Mode auto
RF Band for AM mode scanning all
Native VLAN ID 300 <--- This should be 1.

when I set to VLAN 1, I don't get DHCP IP.

I think I've gone as far as I can with assisting here.

I'm not convinved you have things configured as we have requested and/or the swithcport config you have shown us does not have the AP patched in.

I would recommend re-reading all the recommendations in this thread and in the one I linked to get a better understanding of what should be configured and how bridge mode works.

show interfaces gigabitethernet 0/0/4 switchport

I was able to find the issue, the VLAN 300 wasn't tagged on the switch, after tagging on all my switch I was able to get IP from VLAN 300, Thank you for your kind help. much appreciated. 

You mean - it wasn't tagged on the uplink of the switch? Because your config for gig 0/0/4 showed that it was tagged on that port.

 

Glad you got it working.

no on the Aruba switch itself, I had VLAN 320 untagged with a tagged trunk trk1, I have tagged the ports to VLAN 300 and it was working.

Hmm - think you're missing this command:

switchport trunk native vlan 1

That is of course if that is the VLAN you're using for the IAP to get it's AP.