topic Re: Mobility Anchor/Foreign WLC code versions in Wireless

Mobility Anchor/Foreign WLC code versions

Josh Morris — Sun, 04 Jul 2021 06:13:49 GMT

I am trying to setup a mobility anchor (5500 version: 7.2.111.3). I need this version as to support the Bonjour gateway.

The foreign WLC is a WiSM-1 (version: 7.0.220.0).

I have control/data path up. I am able to ping through it. I am, however, getting invalid mobility packets to the foreign WLC from the Anchor.

Do the code versions have to be identical for a mobility anchor? I do not plan on perofrming any AP roaming to the anchor.

Thanks.

Re: Mobility Anchor/Foreign WLC code versions

Scott Fella — Fri, 14 Dec 2012 17:25:19 GMT

They don't need to be on the same code as I have a mixed environment of some of my client installs. You are allowing bonjour on the DMZ? So the bonjour gateway need to have an interface also in the subnet in order for mDNS to work.

Sent from Cisco Technical Support iPhone App

Re: Mobility Anchor/Foreign WLC code versions

Scott Fella — Fri, 14 Dec 2012 17:26:22 GMT

I'm assuming that the VIP and the mobility groups are setup correct.

Sent from Cisco Technical Support iPhone App

Re: Mobility Anchor/Foreign WLC code versions

Josh Morris — Fri, 14 Dec 2012 18:12:07 GMT

I ended up changing the code on the Mobility ANchor to 7.0.220.0 so they would match. That seemed to stop the invalid packet errors I was seeing, but I still can't get a host to connect. I have confirmed the WLAN settings are the same.

Mobility Anchor:

Cisco Controller) >show mobility summary

Symmetric Mobility Tunneling (current) .......... Enabled
Symmetric Mobility Tunneling (after reboot) ..... Enabled
Mobility Protocol Port........................... 16666
Default Mobility Domain.......................... PNet
Multicast Mode .................................. Disabled
Mobility Domain ID for 802.11r................... 0xf2fc
Mobility Keepalive Interval...................... 10
Mobility Keepalive Count......................... 3
Mobility Group Members Configured................ 2
Mobility Control Message DSCP Value.............. 0

Controllers configured in the Mobility Group
MAC Address        IP Address       Group Name                        Multicast IP     Status
00:1a:6c:20:51:60 10.140.0.23      xxxxxx-m                          0.0.0.0          Up
68:ef:bd:93:bd:00 10.241.15.5      PNet                                  0.0.0.0          Up

Foreign controller:

Symmetric Mobility Tunneling (current) .......... Enabled
Symmetric Mobility Tunneling (after reboot) ..... Enabled
Mobility Protocol Port........................... 16666
Default Mobility Domain.......................... stjude-m
Multicast Mode .................................. Disabled
Mobility Domain ID for 802.11r................... 0x6d68
Mobility Keepalive Interval...................... 10
Mobility Keepalive Count......................... 3
Mobility Group Members Configured................ 9
Mobility Control Message DSCP Value.............. 0

Controllers configured in the Mobility Group
MAC Address        IP Address       Group Name                        Multicast IP     Status
00:1a:6c:20:48:40 10.140.0.21      xxxxxx-m                          0.0.0.0          Up
00:1a:6c:20:51:60 10.140.0.23      xxxxxx-m                          0.0.0.0          Up
00:1a:6c:20:59:e0 10.140.0.25      xxxxxx-m                          0.0.0.0          Up
00:1a:6c:20:60:40 10.140.0.27      xxxxxx-m                          0.0.0.0          Up
00:1a:6c:22:79:e0 10.140.0.22      xxxxxx-m                          0.0.0.0          Up
00:1a:6c:22:83:00 10.140.0.24      xxxxxx-m                          0.0.0.0          Up
00:1a:6c:22:8b:80 10.140.0.26      xxxxxx-m                          0.0.0.0          Up
00:1a:6c:22:91:e0 10.140.0.28      xxxxxx-m                          0.0.0.0          Up
68:ef:bd:93:bd:00 10.241.15.5      PNet                                  0.0.0.0          Up

Re: Mobility Anchor/Foreign WLC code versions

Josh Morris — Fri, 14 Dec 2012 21:32:20 GMT

SO I finally got it working. I removed all my config and re-added it. It is working now. I am still having some issues getting clients to go to a multicast mac gateway, but I'll work through that too. Thanks!

Re: Mobility Anchor/Foreign WLC code versions

Scott Fella — Fri, 14 Dec 2012 21:38:04 GMT

I don't think that multicast is supported through anchoring. It is supported when APs are in local mode and the bonjour gateway has an IP address assigned to each subnet that requires multicast.

Sent from Cisco Technical Support iPhone App

Re: Mobility Anchor/Foreign WLC code versions

Josh Morris — Fri, 14 Dec 2012 21:41:08 GMT

Thats what I was worried about. Let me clarify please...

The mobility anchor sits on a firewall switch and has it's own DMZ. The client subnet points to a default gateway of 10.241.0.10. This address is actually a VIP between three firewalls. The local switch is using a multicast mac entry to forward traffic directed to that particular multicast mac to the proper ports.

So really, when a client connects to this WLAN, are they still going through the mobility anchor to get to the destination (in the EoIP tunnel) or are they bypassing the tunnel after authentication and going directly to their destination?

Re: Mobility Anchor/Foreign WLC code versions

Scott Fella — Fri, 14 Dec 2012 21:49:17 GMT

All traffics goes through the tunnel.

Sent from Cisco Technical Support iPhone App

Re: Mobility Anchor/Foreign WLC code versions

Josh Morris — Fri, 14 Dec 2012 21:52:48 GMT

So a client who is associated on the Mobility Anchor basically use the WLC configured interface to perform all network functions? (arp lookup, traffic forwarding, etc.)

Re: Mobility Anchor/Foreign WLC code versions

Scott Fella — Fri, 14 Dec 2012 21:55:40 GMT

So a client is associated to a foreign WLC and them tunneled to the anchor WLC. The interface you put the traffic on is the interface that does that.

Sent from Cisco Technical Support iPhone App

Mobility Anchor/Foreign WLC code versions

Saravanan Lakshmanan — Sat, 15 Dec 2012 00:24:13 GMT

Yes.

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtr26626

Mobility Anchor/Foreign WLC code versions

Saravanan Lakshmanan — Sat, 15 Dec 2012 00:26:27 GMT

IRCM compatibility matrix

http://www.cisco.com/en/US/docs/wireless/controller/5500/tech_notes/Wireless_Software_Compatibility_Matrix.html#wp102554

Re: Mobility Anchor/Foreign WLC code versions

Josh Morris — Tue, 18 Dec 2012 15:44:22 GMT

Ok so I am still having issues. I downgraded the Anchor to the same code as the foreign controllers (7.0.220) and had it working (with L3 web policy/authentication). The issue then was that I could not get MAC filtering (on failure) to work. I read that this was a bug in 7.0 versions. So I upgraded the Anchor back to 7.2.113 and left the Foreign on 7.0.220. I removed all config and rebuilt it fresh. I can get a client connected and surfing the web if I use no L2/L3 Security. As soon as I turn on L3 Web Policy (Authentication to LDAP) I can get the client connected, but the auth page never loads. I have matched the L2/L3 policy on the Anchor and Foreign controllers. I also tried the L3 web policy as Passthrough, and was able to connect, but the psasthrough page never loads. It just hangs and the Anchor shows me as Associated but noth Authenticated. Any ideas?

Re: Mobility Anchor/Foreign WLC code versions

George Stefanick — Tue, 18 Dec 2012 19:54:48 GMT

Josh,

When the client is connected. On the anchor do you see the client in the anchor controller and if so what PEM state is it in ?

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Re: Mobility Anchor/Foreign WLC code versions

Josh Morris — Tue, 18 Dec 2012 20:00:56 GMT

I do see the client on the Anchor. It is in WEBAUTH_REQD. I get no webauth page on the client though. I have tried a Windows laptop, an iPhone, and Android phone.

Re: Mobility Anchor/Foreign WLC code versions

George Stefanick — Tue, 18 Dec 2012 20:32:14 GMT

To add clarification for my benefit.

If you configure an open ssid and anchor from the foreign / anchor does it work -- yes/no

if you configure open ssid with webauth does it work -- yes/no

Re: Mobility Anchor/Foreign WLC code versions

Josh Morris — Tue, 18 Dec 2012 21:43:04 GMT

With an open/open without any Web Policy, the client can connect and pass traffic.

With open/open with Web Policy, the client can connect (get an IP) but not hit the auth or passthrough page.

Re: Mobility Anchor/Foreign WLC code versions

George Stefanick — Tue, 18 Dec 2012 22:01:18 GMT

Ok lets talk web auth ..

You select web passthrough. Are you using a 3rd party page or are you using a local page, custom page ? Where do you have it pointing ?

Re: Mobility Anchor/Foreign WLC code versions

Josh Morris — Wed, 19 Dec 2012 13:18:20 GMT

I have been set to the internal default page on all L3 web policy.

Re: Mobility Anchor/Foreign WLC code versions

Scott Fella — Wed, 19 Dec 2012 13:24:06 GMT

Attach a txt file of the show wlan on both the foreign and the anchor. Also the show interface detailed virtual on both.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"