Wireless AP Bridge commands

pschulz — Tue, 24 Oct 2023 19:40:24 GMT

In every sample of configuring wireless access points, including Cisco documentation (notably the older Aeronet ones), I find the following lines to be configured on the bridge group which includes the radio interface:

bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled

Yet I can find no explanation anywhere why they are always there, and what do these actually do?

block-unknown-source - the only Cisco doc I find is a configuration sample which states "blocks traffic that comes from unknown MAC address sources". Understandable enough - but none of the samples contain any configuration to specify allowed MAC addresses (including actual live APs, and they work totally fine). I know some APs can be configured to use MAC address authentication, yet on APs not so configured the above line is still present.

no source-learning - same Cisco doc merely states "disables source learning". Great. Learning what? From who? Does it mean automatic MAC-address learning? Would fit to block-unknown-source so that the AP will not learn the MAC of an attacker, but again, where are the allowed MAC addresses? Or is that something totally unrelated to MAC addresses?

no unicast-flooding - I understand the concept, every switch does unicast flooding, but why would we not want this on an AP?

spanning-disabled: this of course disables STP. Yet I do not quite understand how STP even comes into the picture on a wireless AP - typically it has one wired ethernet port and one or more radio antennas. STP would ensure no multiple links between devices exists. How does this apply to wireless APs?

Re: Wireless AP Bridge commands

Rich R — Wed, 25 Oct 2023 13:25:10 GMT

I'm not going to try to answer your questions because I've never tried to work out the answers myself.
The IOS config was originally created for LAN bridging and they re-used it for APs so I've also just accepted the defaults and left it at that.

However it's worth pointing out that most of the IOS APs will be end of support in a few months time (apart from IW3702 which has a few years left) so you should probably not be spending too much time on IOS APs. All the new APs (since Wave 2 AC) run AP-COS which is a completely different OS.

Re: Wireless AP Bridge commands

pschulz — Tue, 07 Nov 2023 18:54:42 GMT

Understood on the (relative) irrelevance of these IOS commands - it's time to move on.

topic Re: Wireless AP Bridge commands in Wireless

Wireless AP Bridge commands

Re: Wireless AP Bridge commands

Re: Wireless AP Bridge commands