topic Re: Just to add... VIP doesn't in Wireless

what virtual IP should i use on a cisco WLC

Peter Boerjesson — Mon, 05 Jul 2021 13:29:54 GMT

I know a lot of documentation says the virtual ip should be 1.1.1.1 and that's what I've used previously. But I recall a friend of mine saying the 1.1.1.1 had been allocated and would actually be used on the internet hence that's a bad address to use now. I know cisco recommended another one (which also is public but would never be used). I've totally forgotten what the new recommended IP address should be, could someone help me out here?

//Peter

Hi

Francesco Molino — Fri, 03 Feb 2017 02:17:26 GMT

This IP wouldn't be routed and just local to the wlc. If you use 1.1.1.1 it doesn't matter. It will be used only for the guest redirection internally to the wlc.

However if you gonna import a trusted certificate, you will need to add the wlc name with this IP in your dns and for that i would like to suggest to use 1 of your internal ip like you do when you create a loopback on your routers.

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

I know you're correct from a

Peter Boerjesson — Fri, 03 Feb 2017 09:45:30 GMT

I know you're correct from a technical point of view and I could use any rfc1918 address i would like to without any issues. Anyway I managed to get a hold of a friend who knew it and new recommendations are 192.0.2.x/24 (by that I assume most people will use .1).

//Peter

Just to add... VIP doesn't

Scott Fella — Fri, 03 Feb 2017 11:32:17 GMT

Just to add... VIP doesn't matter what you use unless you import a certificate like Francesco mentioned. Some still use 1.1.1.1 or 2.2.2.2 or 10., 172. 192.. They all work. With a cert, sometimes you have to use a public IP address to resolve the fqdn is your ISP host the dns servers.

i have used the 192.0. The last two octets of the controllers ip.

-Scott

*** Please rate helpful posts ***

hi,

johnlloyd_13 — Sat, 04 Feb 2017 09:01:05 GMT

hi,

per my WIFUND notes, the virtual interface is used for certain client management functions such as DHCP request and mobility/roaming functions (every controller in the same mobility group should be configured with identical virtual address).

best practice is to use the RFC 1918 address space or RFC 5737 (192.0.2.0/24).

Yes, you should use 192.0.2.x

Rasika Nayanajith — Sun, 05 Feb 2017 18:11:11 GMT

Yes, you should use 192.0.2.x range as it is the recommended best practice (no longer 1.1.1.1)

http://www.cisco.com/c/en/us/td/docs/wireless/technology/wlc/82463-wlc-config-best-practice.html#pgfId-380525

HTH

Rasika

In general I just want "right

Peter Boerjesson — Tue, 07 Feb 2017 06:55:49 GMT

In general I just want "right to be right" (not sure that translates good from Swedish. But I prefer to do as much as best practice. But RFC5737 in combination with what cisco recommends that was what I was after. In this particular case certificates is involed as well though. Case closed and thanks for all the help.

//Peter

Just note that in 8.3, the

danweav — Mon, 08 May 2017 16:38:25 GMT

Just note that in 8.3, the Spartan dashboard's Best Practice tab will flag it as not following best practices if you are using RFC 5737 addressing. So it appears per the BU, that has changed.

Re: Yes, you should use 192.0.2.x

luceroc — Tue, 03 Oct 2017 21:36:28 GMT

Hello Rasika et all, I too have all of my controllers set to use the "old best practice" of 1.1.1.1. In trying to sync up with current best practices do you happen to know how this will affect the users? Isn't that kind of tied into the DHCP communications and redirects? I guess my real question is what kind of downtime would this result in by changing the virtual? I will test this in my lab to be sure but thought it might be a good discussion topic in this thread.

Thanks.

Re: Just to add... VIP doesn't

luceroc — Tue, 03 Oct 2017 21:44:18 GMT

Scott, Are you saying that if youhave 2 WLCs in a RF group or providing access to a building, that you have two different virtual interface IPs? Are they both unique 192.0.x.y? I thought they were supposed to be the same across all controllers ina group?

Re: Yes, you should use 192.0.2.x

mendiratta_vimal — Tue, 15 May 2018 03:37:46 GMT

Hi Rasika,

Links you shared does not exist.

Please advise.

I am using two 8540 WLCs in different DCs in HA.

I am cnofused about the Virtual IP, should i take the mgmt ip for my primary controller or some diff IP.

Please advise.

Thank you.

Regards,

Vimal.

Re: Yes, you should use 192.0.2.x

Rasika Nayanajith — Tue, 15 May 2018 04:05:52 GMT

Hi Vimal,

I think you are talking about management IP address of Active & Standby unit ? Is that correct ?

For Virtual Interface IP Address, it is recommend to use 192.0.2.1

See below example

(WLC-Primary) >show interface summary

management LAG 1000 10.10.0.150 Static Yes No

redundancy-management LAG 1000 10.10.0.148 Static No No

redundancy-port - untagged 169.254.0.149 Static No No

virtual N/A N/A 192.0.2.1 Static No No

(WLC-Standby) >show interface summary

management LAG 1000 10.10.0.150 Static Yes No

redundancy-management LAG 1000 10.10.0.149 Static No No

redundancy-port - untagged 169.254.0.149 Static No No

virtual N/A N/A 192.0.2.1 Static No No

HTH

Rasika

*** Pls rate all useful responses **

Re: Yes, you should use 192.0.2.x

mendiratta_vimal — Thu, 17 May 2018 02:01:45 GMT

Hi Rasika,

Thank you very much for your reply.

I have few queries within your reply.

1. How come primary and secondary wlc has same Management IP?

2. Virtual IP: is this something I have to initialise locally to the controller or it should be advertised to the network (APs).

Regards,

Vimal.

Re: Yes, you should use 192.0.2.x

Rasika Nayanajith — Thu, 17 May 2018 02:34:04 GMT

Hi Vimal,

1. How come primary and secondary wlc has same Management IP?

If you doing HA, then both unit will share same management IP address. They have unique IP on "redundancy management" interface in order you to manage them individually.

2. Virtual IP: is this something I have to initialise locally to the controller or it should be advertised to the network (APs

No, this is not a routable within your network. Just define it on your WLCs which need to be in same mobility cluster.(ie same virtual IP address in all your WLCs as long as they establish mobility peering)

HTH

Rasika

*** Pls rate all useful responses ***

Re: Yes, you should use 192.0.2.x

mendiratta_vimal — Thu, 17 May 2018 02:46:20 GMT

Legend, I wish Cisco Would have explained in that simple way.

Thank you.

Regards,

Vimal.

Re: Just to add... VIP doesn't

jham1992 — Tue, 17 Jul 2018 14:10:36 GMT

How does importing a cert effect affect the Virtual IP? I have this issue on multiple controllers. Android devices won't connect. Some have certs that were imported. It was recommended that I get a cert, but another party recommended I change the virtual IP. The current VIP is 1.1.1.1

Re: Yes, you should use 192.0.2.x

ERAJAB — Tue, 18 Sep 2018 08:50:54 GMT

Virtual IP is used for three things:

* DHCP proxying (WLC hides the real DHCP server identity to the clients and shows this instead)

The Virtual IP address does not really matter here.

* Guest login splash page redirection. If WLC is to present the guest login screen it uses the

Virtual IP. Should be a non-existing, non-routable address.

* Mobility tunnel creation to other WLC´s. All WLCs must share the same Virtual IP address

to form a group besides the group/domain configuration as well as same SW version
(well, its recommended but there are exceptions where different versions work)

Some cloud proxies have started to use 1.1.1.1 for their proxy, and this breaks the guest login

splash page presentation if used. If virtual IP is changed the mobility tunnels might break, so this

should be changed for all WLCs in the same Mobility Domain in same service window.

Re: Yes, you should use 192.0.2.x

quintinellis — Mon, 29 Oct 2018 10:17:35 GMT

Hi,

How would you go about changing an estate of 30 + controllers from 1.1.1.1 to 192.0.2.x?

Is it as simple as one at a time?

Re: Just to add... VIP doesn't

quintinellis — Tue, 06 Aug 2019 07:13:22 GMT

Hi Scott,

So my understanding of the virtual IP is that it is globally used from WLC perspective for all configured SSID clients (DHCP, roaming mobility)?

So if you need to change this to a public IP for DNS resolution from ISP (BYOD SSID on anchor WLC's), how does this affect the "safety" of the private/corporate internal SSID's?

Or is this where the cert comes in?

Where do you install the cert, only on anchor side?

Thanks

Quintin

Re: Yes, you should use 192.0.2.x

sstade — Thu, 05 Sep 2019 14:27:41 GMT

Hello,

We are facing the same issue. We have over 40 WLC 5508 all with same virtual 1.1.1.1

Any recommendations on how to maybe leave 1.1.1.1 in place with a DNS type work around? Or suggest easy way to change all? Big issue is when you change virtual 1.1.1.1 address you have to reboot (x40) the WLCs for it to take affect...!!

Thanks in advance