topic Office Extend Mode in Wireless

Office Extend Mode

nshoe18 — Sun, 04 Jul 2021 03:57:44 GMT

I have got a 3502 setup anf functioing in Office Extend mode. I have found one issue though. I have to set the checkbox on the my Management Interface to Enable NAT Address and put the external address in the box. Once this occurs no internal APs can join the controller.

Does anyone have any ideas on setting this up with a single controller behind a router and not having to set the NAT Address for the Management interface? Should I setup a second interface on the controller to be for external management?

Re: Office Extend Mode

Stephen Rodriguez — Thu, 20 Oct 2011 13:21:53 GMT

there was a defect raised against this, and I thought it was fixed in later 6.0 and 7.0 codes.

There is a workaround to this as well. Basically you need the FW rules to allow the internal ap to hairpin back into the network to reach the NAT address.

HTH,

Steve

Sent from Cisco Technical Support iPad App

Re: Office Extend Mode

nshoe18 — Thu, 20 Oct 2011 13:27:43 GMT

When you say the FW, are you talking about the remote side or the corporate side?

Office Extend Mode

Stephen Rodriguez — Thu, 20 Oct 2011 13:55:06 GMT

where the controller is.

HTH,

Steve

----------------------------------------------------------------------------------------------------------

Please remember to rate helpful posts or to mark the question as answered so that it can be found later.

Re: Office Extend Mode

nshoe18 — Thu, 20 Oct 2011 14:22:54 GMT

I think I just saw what you mean. I have the NAT statement in there but no Access-List for the UDP ports needed. That is what you are referencing correct?

Re: Office Extend Mode

George Stefanick — Thu, 20 Oct 2011 15:12:51 GMT

I wanted to chime in with a quick comment. If you give your WLC an outside address you can avoid the NAT all together.

Re: Office Extend Mode

nshoe18 — Thu, 20 Oct 2011 15:18:30 GMT

Then how would my internal APs connect?

Sent from Cisco Technical Support iPad App

Re: Office Extend Mode

George Stefanick — Thu, 20 Oct 2011 15:26:27 GMT

From the inside (dpending on your FW rules) you should be able to hit the DMZ becuase you are more TRUSTED. You can of course lock it down to ports from inside to DMZ and only allow the APs traffic and client traffic to pass. But most people from the inside allow traffic to the DMZ. And then restrict from the DMZ back in ...

Re: Office Extend Mode

nshoe18 — Thu, 20 Oct 2011 15:40:49 GMT

Since we are small, I only have a single controller and no true DMZ per se. I have setup an ACL just haven't tested it yet.

Sent from Cisco Technical Support iPad App

Re: Office Extend Mode

George Stefanick — Thu, 20 Oct 2011 15:46:30 GMT

Ok, well no worries. As Steve pointed out there is/was a NAT issue on earlier code. I think it was fixed in M1. but again, if you give the WLC an outside address and protect it with ACLs from the outside and allow your internal folks to hit it from the inside you should be ok. But again, I dont know how your network is designed or your specific design requirements. Please take these as suggestions as they may apply.

Perhaps Steve can add to this as well...