topic WLC 2504 Interface configuration in Wireless

WLC 2504 Interface configuration

T_tow — Mon, 05 Jul 2021 15:20:27 GMT

Hello,

So I have a 2504 controller and want to set up a guest interface. While setting up the interface's dhcp server should this server sit on a router on-site? I know it shouldn't be on the same subnet as my data vlan but where should I be drawing ip addresses from for guests?

Re: WLC 2504 Interface configuration

Flavio Miranda — Mon, 05 Mar 2018 21:14:15 GMT

Hi @T_tow

Cisco WLC supports two modes for DHCP: Transparent and Proxy. Proxy is the default mode.

If in proxy mode the DHCP server does not have to be on the same subnet. As the WLC send a unicast packet to request the DHCP, the server can be anywhere as long as it is reachable by the wlc interface.

As transparent mode you need to have the DHCP server on the same segment or use IP helper address on the next device.

-If I helped you somehow, please, rate it as useful.-

Re: WLC 2504 Interface configuration

T_tow — Mon, 05 Mar 2018 21:38:49 GMT

Thanks for the reply. Well I was looking at the set up of a similar wlc and the confusing thing for me is they have a guest interface of 192.168.x.x/24 with a gateway of .1 and the primary dhcp server of .1 but this whole site is on a 10.x.x.x so the management vlan is 10.x.x.x/24. There is no ip helper on any device to point to a 192 subnet so I was wondering where it might have come from. Kind of new. Any ideas on this?

Re: WLC 2504 Interface configuration

d.friday — Mon, 05 Mar 2018 22:33:17 GMT

Does it have a VLAN assigned to that interface ? you should be able to see it by going by clicking on Controller, and Click on interfaces on the left hand side of the page and then click on the interface that is setup for guest.

Re: WLC 2504 Interface configuration

T_tow — Mon, 05 Mar 2018 22:41:39 GMT

No it's actually left on 0 and untagged. I'm thinking maybe there's a dhcp server I don't know about but I can't figure out where the 192.168x.x came from when we use a 10 subnet everywhere else from what I've seen.

Re: WLC 2504 Interface configuration

Flavio Miranda — Mon, 05 Mar 2018 22:56:45 GMT

Have you checked if they have DHCP server on the wlc itself?

-If I helped you somehow, please, rate it as useful.-

Re: WLC 2504 Interface configuration

T_tow — Mon, 05 Mar 2018 23:07:38 GMT

Yes I checked for an internal dhcp server but there wasn't one. This is under the guest configuration. The management interface is the usual 10 subnet. I can't ping or traceroute to this address.

Re: WLC 2504 Interface configuration

Flavio Miranda — Mon, 05 Mar 2018 23:26:56 GMT

Just send the output of "show dhcp summary" and "show dhcp scope"

-If I helped you somehow, please, rate it as useful.-

Re: WLC 2504 Interface configuration

T_tow — Mon, 05 Mar 2018 23:47:30 GMT

Those wlc's are off site and I can't telnet into them I can only use the GUI.

Re: WLC 2504 Interface configuration

Flavio Miranda — Mon, 05 Mar 2018 23:56:40 GMT

Alright. The IP address configured on the guest interface as DHCP server must be reachable by the wlc. From the wlc web interface you must be able to ping it.

-If I helped you somehow, please, rate it as useful.-

Re: WLC 2504 Interface configuration

T_tow — Tue, 06 Mar 2018 00:05:01 GMT

Def sure it's pingable.......I guess I'm trying to figure out the relevance of using the 192 sub for guest but maybe it could have something to do with the fw is my guess.

Re: WLC 2504 Interface configuration

Flavio Miranda — Tue, 06 Mar 2018 01:15:46 GMT

I believe it is to differentiate from the Corp network. Usually it is a good idea to have logical and physical separation between both network. When physical is not possible, at least logical.

-If I helped you somehow, please, rate it as useful.-

Re: WLC 2504 Interface configuration

T_tow — Tue, 06 Mar 2018 14:25:55 GMT

Yes Flavio I can see that. I now think these group of ips is coming from the AD thus also setting up radius. Haven't gotten access to the AD yet but we'll see.

Re: WLC 2504 Interface configuration

Flavio Miranda — Tue, 06 Mar 2018 15:03:47 GMT

On the WLAN, security tab, under layer 2 and layer 3 you can confirm which kind of security method it is using. For AD, usually 802.1x is selected. But for Guest is more usually used Web auth.

If possible you can share the output of "show running-config" of WLC and we can try to help you identify.

-If I helped you somehow, please, rate it as useful.-

Re: WLC 2504 Interface configuration

T_tow — Tue, 06 Mar 2018 16:49:00 GMT

I wish I could but I can't get into those wlc's on the cli just the gui. I do know there's the employee network set up 802.1, employee byod set up 802.1, and the guest net with web-auth. Now interface wise byod and guest are on the same interface which was why I believed the dhcp was in the AD. Hopefully I can get in there to check.