topic Re: Virtual Interface (WLC) in Wireless

Virtual Interface (WLC)

sniff — Sun, 04 Jul 2021 07:53:41 GMT

Hello,

are there any background information about the virtual Interface and his IP-address:　

[Config Guide]

.....　

A virtual interface must be configured with an unassigned and unused gateway IP address. (no question !!)

A virtual interface IP address is not pingable and should not exist in any routing table in your network. (why? The controller have this IP address and no other systems, what ist the problem?)

Regards

Sven

Re: Virtual Interface (WLC)

Rasika Nayanajith — Fri, 20 Sep 2013 09:31:36 GMT

Because virtual IP address has to be same on your controllers, if you configured it as routable IP, routing table will get confused (as same IP coming from multiple places of your network).

Normally we configure 192.0.2.1 as virtual IP (old days it was 1.1.1.1) now a days

HTH

Rasika

**** Please rate all useful responses ***

Virtual Interface (WLC)

sniff — Fri, 20 Sep 2013 09:44:23 GMT

Hello Rasika,

I thougt the virtual IP is used internal or for Wireless clients only?

Are there any IP packets go out from the controller to LAN?

What about L2 networks and more than 1 controller?

Sven

Re: Virtual Interface (WLC)

Rasika Nayanajith — Fri, 20 Sep 2013 18:09:03 GMT

Yes, you are correct, virtual IP address is used for communication for wireless client & controller itself, Assume you configure it as a routable IP, then WLC will forward that traffic to Network & cannot do its intended function.

Also if you have more than 1 controller & you need to have mobility between them then you need to configure same virtual IP address all of those controllers.

Here are the some of useful points about this interface from config guide.

http://www.cisco.com/en/US/docs/wireless/controller/7.0MR1/configuration/guide/cg_ports_interfaces.html#wp1194487

* The virtual interface is used to support mobility management, Dynamic Host Configuration Protocol (DHCP) relay, and embedded Layer 3 security such as guest web authentication and VPN termination. It also maintains the DNS gateway host name used by Layer 3 security and mobility managers to verify the source of certificates when Layer 3 web authorization is enabled.

Specifically, the virtual interface plays these two primary roles:

1. Acts as the DHCP server placeholder for wireless clients that obtain their IP address from a DHCP server.

2. Serves as the redirect address for the web authentication login page.

* The virtual interface IP address is used only in communications between the controller and wireless clients. It never appears as the source or destination address of a packet that goes out a distribution system port and onto the switched network. For the system to operate correctly, the virtual interface IP address must be set (it cannot be 0.0.0.0), and no other device on the network can have the same address as the virtual interface. Therefore, the virtual interface must be configured with an unassigned and unused gateway IP address. The virtual interface IP address is not pingable and should not exist in any routing table in your network. In addition, the virtual interface cannot be mapped to a backup port.

* All controllers within a mobility group must be configured with the same virtual interface IP address. Otherwise, inter-controller roaming may appear to work, but the handoff does not complete, and the client loses connectivity for a period of time.

HTH

Rasika

**** Please rate all useful responses ****

Re: Virtual Interface (WLC)

sniff — Tue, 24 Sep 2013 10:58:10 GMT

It never appears as the source or destination address of a packet that goes out a distribution system port and onto the switched networ

Thats the reason why I ask

If it never used, where is the problem with any routing tables?

Re: Virtual Interface (WLC)

Rasika Nayanajith — Tue, 24 Sep 2013 20:35:43 GMT

It says it will not appear as source or destination address of a packet goes out a distribution system port (in other words packets goes to wired network). Still this can be used for within the controlller and encapsulated capwap tunnel for client traffic in certain scenarios(in mobility management).

If your wired network know about this virtual IP (ie routable IP), then it will be problematic to do this segregation. On top of that how can you configure the same IP address available in multiple places of your network & do routing for that.

HTH

Rasika

Re: Virtual Interface (WLC)

sniff — Wed, 25 Sep 2013 09:02:41 GMT

Thanks for your support

Sven

Virtual Interface (WLC)

Rasika Nayanajith — Wed, 25 Sep 2013 09:07:02 GMT

No prob... Thanks for rating the responses...

Rasika

Re: Virtual Interface (WLC)

Svetlin Simeonov — Sat, 30 Jun 2018 15:31:19 GMT

I want to buy public SSL certificate for guest registration page of our wireless controller. So currently controller use his virtual ip address (1.1.1.1) for guest page this is Passthrought authentication. I wont to change this ip address to your suggested 192.0.....

The question is can we use ip address of virtual interface for CSR generation or must use DNS for this?

IP of controller 1.1.1.1 = CN for CSR ?

Controller is with 8.0.152 version of IOS.

Thank you.

Re: Virtual Interface (WLC)

Scott Fella — Sat, 30 Jun 2018 16:11:47 GMT

The CN needs to be a FQDN that you would have a record in DNS to match that of the VIP. The DNS being used for guest needs to have that record or else you will get a cert error.

Re: Virtual Interface (WLC)

Svetlin Simeonov — Fri, 06 Jul 2018 14:36:49 GMT

So we need record in DNS for VIP address on controller right ?

The record will look like this :

X.domain.X > to address 1.1.1.1

I have plan to change VIP from 1.1.1.1 to non routable - 192.0.2.1.

Re: Virtual Interface (WLC)

Scott Fella — Fri, 06 Jul 2018 14:42:24 GMT

That will work as long as you can add the dns entry to the dns servers guest will be assigned. I have tied the dns cn to a public address which is easier if you don’t manage your own external dns servers.

Re: Virtual Interface (WLC)

Svetlin Simeonov — Fri, 06 Jul 2018 14:54:57 GMT

Yes unfortunately we have access to DNS server for guest ( this DNS server is our router and guest interface is directly pointed to DMZ on this router).

OK finally we must to have:

DNS record like this WLC.domain.com pointed to 1.1.1.1 or 192.0.2.1 and internal guest page will look like this after redirect:

WLC.domain.com/screens/base/login_preview.html

After our guest is redirected to this page they will click on accept button and will get internet access.

For CSR we need

DNS record for virtual IP on controller - WLC.domain.com pointed to 1.1.1.1 or 192.0.2.1.

and that is actually our FQDN right ?

Re: Virtual Interface (WLC)

Scott Fella — Fri, 06 Jul 2018 15:32:06 GMT

The CN that you specify in the cert (CSR) needs to be resolved to the WLC VIP address.

Re: Virtual Interface (WLC)

Svetlin Simeonov — Fri, 06 Jul 2018 16:29:36 GMT

Thank you Scott !

Re: Virtual Interface (WLC)

PK501 — Mon, 29 Oct 2018 13:39:40 GMT

---Edit---
Hello,

I ran into this situation recently and the question i have is, can we use a public IP from company's public IP range (something like 198.x.x.100) and create a DNS entry on the external DNS servers (say AT&T) and make this work.?
FYI- the IP used for virtual interface is not used anywhere in the network and not pingable internally or externally.

I appreciate any suggestions. Thanks in advance!

Re: Virtual Interface (WLC)

Scott Fella — Sun, 28 Oct 2018 19:04:20 GMT

Yes that will work. I have done that many times when the DNS used for guest is public. I also have done that for my home lab for testing guest and NAT of OEAP.

Re: Virtual Interface (WLC)

PK501 — Mon, 29 Oct 2018 13:40:10 GMT

Thanks Scott!

Re: Virtual Interface (WLC)

Rusty Sukhram — Tue, 23 Apr 2019 22:02:04 GMT

Hi,

I am in similar situation.. So guest controller is connected to DMZ to access internal DNS should we add rule on firewall to allow dns to be accessed by anchor controller?

Thanks,

Mounica

Re: Virtual Interface (WLC)

Sathiyanarayanan Ravindran — Wed, 24 Apr 2019 05:48:02 GMT

No, for anchor you don’t need to provide access.

Configure the Public IP as Virtual Interface IP in anchor . Create URL for the same.

On ur internal DNS server create Host entry for the URL with respect to the Public IP.

So once the client connect, Virtual Interface URL will be resolved by ur DNS configured on the Client subnet.