topic Re: C9105AXI EWC default route not working in Wireless

C9105AXI EWC default route not working

marvin9876 — Wed, 26 Apr 2023 10:07:02 GMT

Software: 17.06.04

Hello,

did the Day 0 Wizzard like described in the whitepaper:

https://www.cisco.com/c/en/us/products/collateral/wireless/embedded-wireless-controller-catalyst-access-points/white-paper-c11-743398.html#Gettingstarted

Exceptions are that I simplified the test with only one vlan untagged on the switchport the EWC-AP is connected to and I want to give an static IP instead of DHCP.

After that I can ping the IP of the EWC-AP within the same subnet. next I configured a default route (ip route x.x.x.x x.x.x.x x.x.x.x) but cannot reach the AP from an other subnet aswell as the AP cant reach other subnets via ICMP. Also disabling ip routing and setting a ip default-gateway does not work. Why is this basic function such a pain and why is there no field for defgw in the Day-0 Wizzard on GUI and CLI ?!?!

Also after I reboot I cant even ping the given IP from within the same subnet and the AP cant ping its own IP aswell. The show ip interface show the if on gig0 as up:

GigabitEthernet0 is up, line protocol is up
Internet address is 10.x.x.5/24
Broadcast address is 255.255.255.255

the route is in the routing table:

S* 0.0.0.0/0 [1/0] via 10.x.x.1

I removed the default interface route (ip route 0.0.0.0 0.0.0.0 GigabitEthernet0).

Help would be much appreciated.

Re: C9105AXI EWC default route not working

Mark Elsen — Wed, 26 Apr 2023 10:18:18 GMT

- Have a checkup-review of your EWC controller current configuration with the CLI command : show tech wireless , have the output analyzed with : https://cway.cisco.com/wireless-config-analyzer
Checkout all advisories!

Re: C9105AXI EWC default route not working

marvin9876 — Wed, 26 Apr 2023 11:58:36 GMT

There was nothing relevant in the output which relates to my problem only that apperently something is missing:

WCAE: Parsing: missing configuration file section(s), checks may not be executed properly:Interface Config,RF Profile Conversion,Policy Profiles

Action: One or more configuration sections were not found, this is indication of corrupted file, or very old software version. If the file is believed to be correct, please contact wcae@cisco.com, otherwise try to capture it again: https://developer.cisco.com/docs/wireless-troubleshooting-tools/#!how-to-colletct-sh-run-config

Re: C9105AXI EWC default route not working

Mark Elsen — Wed, 26 Apr 2023 12:36:46 GMT

- Also note https://www.cisco.com/c/en/us/support/docs/wireless/embedded-wireless-controller-on-catalyst-access-points/215303-embedded-wireless-controller-conversion.html#toc-hId--1773290237 , especially do not use SVI's and or let routing statements depend on them ,

Re: C9105AXI EWC default route not working

marvin9876 — Wed, 26 Apr 2023 13:04:02 GMT

I am using the IP Address directly on the ge0 Interface (no SVI). I just want to reach the EWC-AP Management IP via a router.

The only configuration I have changed after the wizzard is this:

interface GigabitEthernet0
mac-address 0000.5e00.0101 <- default which cant be removed
ip address 10.78.40.5 255.255.255.0

ip route 0.0.0.0 0.0.0.0 10.78.40.1

Re: C9105AXI EWC default route not working

Mark Elsen — Wed, 26 Apr 2023 13:12:33 GMT

>.... mac-address 0000.5e00.0101 <- default which cant be removed
- A strange statement try from config mode : default int Gi0 , and configure it again according to your needs ,

Re: C9105AXI EWC default route not working

marvin9876 — Wed, 26 Apr 2023 13:55:56 GMT

After defaulting the interface it looks like this:

interface GigabitEthernet0
mac-address 0000.5e00.0101
no ip address
negotiation auto
!

Still doesnt work when I give it an IP

Re: C9105AXI EWC default route not working

marvin9876 — Wed, 26 Apr 2023 13:56:57 GMT

Also in the MAC-Address-Table of the connected Switch I see both MAC-Addresses. Already Did a factory reset aswell..

Re: C9105AXI EWC default route not working

Mark Elsen — Wed, 26 Apr 2023 14:51:47 GMT

- It seems that mac-address 0000.5e00.0101 is being used only in the config if VRRP is configured which is the only High Availability method that the EWC(s) can support , you may try to config from scratch again , but don't use or setup VRRP anywhere in the menu's when you don't need it ,

Re: C9105AXI EWC default route not working

marvin9876 — Thu, 27 Apr 2023 13:30:21 GMT

Indeed the MAC seems to be related to VRRP. Also the log of the connected switch is spammed with DOS invalid IP Alerts from the VRRP announcements: VRF 0: DoS type invalid ip from 0.0.0.0/90:e9:5e:89:03:18 on port 1/1/1 <- Using the other MAC-Address.
But I did not configure any VRRP in the wizzard or afterwards. And the only VRRP command I found in he CLI reference Guide was this: wireless ewc-ap vrrp vrid <value>, which is not helpful.

I have now upgraded the controller to 17.6.5 (recommended) but still the same behaviour. I can not belive to say this, but this is my second full day of troubleshooting a network device which does not accept a default gateway!

Re: C9105AXI EWC default route not working

Mark Elsen — Thu, 27 Apr 2023 16:12:47 GMT

>...second full day of troubleshooting a network device which does not accept a default gateway!
- I would like to do some back tracking on this : meaning why don't you let the needed VLANS 'arrive on the EWC only' and do all of the needed routing for them on the (backend) core (e.g.) ?

Re: C9105AXI EWC default route not working

marvin9876 — Fri, 28 Apr 2023 08:19:33 GMT

This is the plan, to bridge the WLAN clients in the respective VLAN and let the coreswitch do the routing. However, the EWC needs to be managed via a routed network and therefore needs a default gateway (we don't want to implement NAT at its location). Or what exactly do you mean by 'arrive on the EWC only'? Because I thought with the EWC only Flex port is supported and Data traffic cannot be tunneled to the EWC with CAPWAP?

The following configuration lines will be included in the configuration after a reboot, even if they are deleted and saved beforehand:

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0 250

interface GigabitEthernet0
ip dhcp client client-id GigabitEthernet0
ip dhcp client broadcast-flag clear

When I set up a DHCP server on the EWC for the AP with a default gateway, the EWC seems to use that defgw itself. It feels like the EWC is forwarding its traffic to the AP, but I really don't understand the behavior. Am I missing a something here or is there a functionallity active which I can disable?

Re: C9105AXI EWC default route not working

Mark Elsen — Fri, 28 Apr 2023 08:49:22 GMT

>...the EWC needs to be managed via a routed network
For management access you may need to specify the management vrf in the routing statement too as in :
ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 <gateway>

>...When I set up a DHCP server on the EWC for the AP with a default gateway, the EWC seems to use that defgw itself.
- That is something that I certainly would not do , doubt if that is even supported , use an external DHCP server for the APs with the needed parameters given upon DHCP offerings such as the default gateway. As a result disable DHCP on the EWC. For DHCP don't use Cisco equipment, preferably use the modern ways = using a DHCP appliance,

- Flex discussion is somewhat unrelated , client data is switched locally indeed , then the APs on (remote) site need ports configured with trunk links for the WLAN/VLANS supported and or defined

Re: C9105AXI EWC default route not working

marvin9876 — Fri, 28 Apr 2023 11:09:23 GMT

> For management access you may need to specify the management vrf in the routing statement too as in ...

Can I find this part in the configuration guide or in any other sources? show vrf doesnt provide any output and additional VRF´s are not found neither on the GUI nor CLI.

> That is something that I certainly would not do... preferably use the modern ways = using a DHCP appliance,...

I dont want to use the integrated DHCP Server on the EWC this is just a behaviour I recognized while trying out different things. There will be a DHCP server for the APs running on the coreswitch.

> Flex discussion...

Yes, there will be a trunk port with native VLAN for mangament and tagged VLANs for client traffic at the end.

For now I just want to have the EWC configured with a static IP and working default gateway.

Re: C9105AXI EWC default route not working

Rich R — Fri, 28 Apr 2023 16:09:14 GMT

Works fine for me on 17.9.3 and all previous versions it was on:
C9120AXI-WLC#sh run | inc ip route |default-gateway
ip default-gateway 192.168.1.1
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0 192.168.1.1
ip route 0.0.0.0 0.0.0.0 GigabitEthernet0 250
C9120AXI-WLC#ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/3 ms
C9120AXI-WLC#

To be honest I can't remember what it configured by default and what I added but I have default-gateway and ip route in the config.
I generally would not use interface without next hop IP so it probably added that itself.
I'm also using static IP. G0 also has:
ip dhcp client client-id GigabitEthernet0
ip dhcp client broadcast-flag clear
Presume it added that on day 0 but probably serving no useful purpose now that it has a static IP.
ps: Just to add mine has "ip routing" configured so it should be using the routes and ignoring the default gateway.

Re: C9105AXI EWC default route not working

marvin9876 — Thu, 04 May 2023 12:35:01 GMT

Now I have a DHCP Server running on the coreswitch which gives an IP and a default gateway to the AP. After this in the "day-0-wizzard" I have configured the EWC with an IP in the Subnet of the AP DHCP-Lease. Afterwards I can ping hosts in other Subnets without the configuration of a default Gateway. This leads me to the conclusion that the EWC routes its traffic via the AP. The Routing on the EWC is done via the default Interface Route (ip route 0.0.0.0 0.0.0.0 GigabitEthernet0 250) and then switched on the network with the source MAC configured per default on the GE0 Interfcace (e.g. mac-address 0000.5e00.0101). Traffic from the AP is switched with a Source MAC of the AP (Label on the back).

To get the EWC up and running with a static IP the AP needs an IP and default Gateway and these need to be in the same subnet as EWC mgmt IP.

Re: C9105AXI EWC default route not working

Rich R — Thu, 04 May 2023 11:45:18 GMT

> This leads me to the conclusion that the EWC routes its traffic via the AP.
I disagree.

> AP needs an IP and default Gateway and these need to be in the same subnet as EWC mgmt IP.
This is a requirement and a logical necessity because they share the same physical port connected to the network and you can't use VLANs on the WLC part.