topic Re: VLAN & DHCP Issue in Wireless

VLAN & DHCP Issue

Uberseehandel — Sat, 06 Jan 2018 19:28:57 GMT

I am re-configuring my test network and an unexpected error has occurred. I am in the first stage of moving devices to appropriate VLANs. The VLANs used by the two SSIDs are circled in the screenshot below -

The phone attaches either of the SSIDs as selected -

However, the Access Point is reporting an error -

Doubtless, I've done something silly, but I am a little surprised at the mention of VLAN 0.

Any suggestions greatly welcomed.

Re: VLAN & DHCP Issue

Philip D'Ath — Sat, 06 Jan 2018 19:42:33 GMT

Have you tried getting the phone to release and renew its DHCP address? It may be holding onto its last lease assignment.

Re: VLAN & DHCP Issue

Uberseehandel — Sat, 06 Jan 2018 20:57:57 GMT

Philip

Thanks for your interest.

I just tried getting the phone to forget both networks so it was unattached and then re-attached to VLAN 111 Analytics ( via the Enigma SSID. I still get the same error message and the orange status on the AP.

The default is VLAN 1 not 0. The switch and the AP are on the management VLAN 11. Eventually, I intend removing VLAN 1 and I do not see that I need VLAN 0 (is that a normal VLAN), if everything is specifically assigned?

I'm a bit puzzled.

Re: VLAN & DHCP Issue

MilesMeraki — Sat, 06 Jan 2018 21:22:01 GMT

My assumptions are that the error message is for the AP not the phone. How's the AP configured, is it configured to receive an IP address via DHCP? Make sure there is no VLAN tagging set on the AP's DHCP configuration as I assume it's already being tagged at the Switch port? (Double tagging could cause this error message)

Re: VLAN & DHCP Issue

Philip D'Ath — Sat, 06 Jan 2018 22:17:14 GMT

Reading this again I missed this was an AP issue.

I would think by "VLAN0" it means the native or untagged VLAN.

The switch port that that the AP plugs into, I assume it is a trunk port. Is the native VLAN - VLAN1, or a different native VLAN?

Re: VLAN & DHCP Issue

Uberseehandel — Sat, 06 Jan 2018 22:23:26 GMT

@MilesMeraki

Thanks for your suggestion - the screenshot below shows how the AP is configured -

Both the SSIDs function as expected. The AP is getting its IP address from the correct VLAN DHCP server. I am not sure where to go looking for more causes . . .

Re: VLAN & DHCP Issue

Philip D'Ath — Sat, 06 Jan 2018 22:35:28 GMT

Try checking the config on the local status page. Particularly the VLAN assigned there.

If it all still looks correct perhaps give the AP a power cycle.

To me, everything looks configured correctly.

Re: VLAN & DHCP Issue

Philip D'Ath — Sat, 06 Jan 2018 22:37:05 GMT

You mention a switch.

So you have an MX, and on LAN1 it connects to a switch? And then the AP plugs into that switch?

Re: VLAN & DHCP Issue

Uberseehandel — Sat, 06 Jan 2018 22:40:46 GMT

@Philip D'Ath wrote:
Reading this again I missed this was an AP issue.
I would think by "VLAN0" it means the native or untagged VLAN.
The switch port that that the AP plugs into, I assume it is a trunk port. Is the native VLAN - VLAN1, or a different native VLAN?

At present he "default" VLAN is VLAN 1. At present all the switch ports are trunk ports.

My aim is to use VLAN 11 as the management VLAN and avoid using any defaults.

Its after 2235 here I'll get back to this in the morning (my time), thank you for your assistance.

Do I need to do anything on the switches other than set which VLANs each port will pass? Do I need to set up the ports to also pass the management VLAN when a client device is directly attached?

laters . .

Re: VLAN & DHCP Issue

Philip D'Ath — Sat, 06 Jan 2018 22:51:11 GMT

Since the AP is configured to use VLAN11, the port it plugs into on the switch should be a trunk port, and it can use a native VLAN of 1 (make sure the switch is not using a native vlan of 11). Make sure the switch port that connects to the MX is also a trunk port. Is this a Meraki switch?

Re: VLAN & DHCP Issue

Uberseehandel — Sun, 07 Jan 2018 07:32:48 GMT

@Philip D'Ath

I've accessed the local pages for the switch (MS220-8P) and the AP, everything appears to be Healthy.

However, I check the entry on the switch port page and it shows that that the port the switch is connected to has

Native VLAN - 11

Allowed VLAN - 11, 111, 1001

(11 Management, 111 Analytics, 1001 Isolated Guests)

- is this correct?

Re: VLAN & DHCP Issue

Uberseehandel — Sun, 07 Jan 2018 07:34:16 GMT

@Philip D'Ath
LAN1 port on MX plugs into the MS220-8P port 10

Re: VLAN & DHCP Issue

Philip D'Ath — Sun, 07 Jan 2018 07:40:51 GMT

You have two choices:

1. Configure the native VLAN configured as "1". Nothing will use it, as you have everything configured to use other VLANs.

2. Leave the native VLAN as 11 but change the AP backup to using VLAN1 - which will actually end up on VLAN11.

Re: VLAN & DHCP Issue

Philip D'Ath — Sun, 07 Jan 2018 07:41:52 GMT

Sorry this is between the switch and the MX.

I would make the native VLAN "1", and configure the switch to use VLAN11 as its management VLAN via the local status page on the switch.

Re: VLAN & DHCP Issue

MilesMeraki — Sun, 07 Jan 2018 08:42:48 GMT

Double tagging is the issue here. As @Philip D'Ath has stated, the Native VLAN is 11 and the AP is using VLAN 11 for it's DHCP requests when the Native VLAN is already VLAN 11.

As @Philip D'Ath has mentioned, change the Native VLAN back to 1 and this will resolve the issue.

Re: VLAN & DHCP Issue

Uberseehandel — Sun, 07 Jan 2018 09:26:51 GMT

@MilesMeraki

@Philip D'Ath

Thanks for your help guys, it is much appreciated.

As you both predicted, changing the native VLAN for the AP(s) back to 1 solved the problem.

Because of my background, I'd prefer it if there was not a default VLAN, and to avoid using VLAN 1, because both 0 and 1 are predictable and often default values.

I'm trying to develop a core architecture that can act as a template for future deployments, rather than configure on a one-off basis.

I am not a network engineer, so what is obvious to everybody else is not always obvious to me. As I said before, your assistance is much appreciated.

Robin

Re: VLAN & DHCP Issue

Philip D'Ath — Sun, 07 Jan 2018 09:29:46 GMT

You can choose a non-existent VLAN to be the default if you want, like 123. But you must configure it as the native VLAN on each side of a trunk link.

Re: VLAN & DHCP Issue

MilesMeraki — Sun, 07 Jan 2018 21:07:02 GMT

No problem @Uberseehandel, glad that we could be of assistance. As @Philip D'Ath has stated above, if you believe keeping VLAN 1 as the default Native VLAN as being insecure/vulnerable, change it to another unused VLAN number in your design, just ensure that you change the Native VLAN on all other links to reflect it.

Re: VLAN & DHCP Issue

Uberseehandel — Mon, 08 Jan 2018 09:30:13 GMT

@MilesMeraki

@Philip D'Ath

I've found a lot of information on the Cisco education site so I'll take it on board (hopefully weeding out the misleading stuff), and I'll re-organise the VLAN numbering scheme accordingly. I'm tempted by (room) 101 for the unused VLAN.

Re: VLAN & DHCP Issue

zilla — Wed, 10 Jan 2018 18:35:56 GMT

If you want the AP to be on VLAN 11 and the switch port to use VLAN 11 as it's native (or untagged) VLAN, here's what you should try.

Set the AP to DHCP and leave the VLAN tag blank.

Then set the switch port to native VLAN 11.

Then bounce the port.

If the AP's configured management VLAN matches the native VLAN on the switch port you will get this error.

The AP doesn't have a way of knowing what native VLAN the switch is configured for. In this case, it just knows that it's configured to use DHCP on a VLAN that it never gets traffic with the expected VLAN tag from the switch.