topic Re: Can not reach the WLC using Flexconnect AP in Wireless

Can not reach the WLC using Flexconnect AP

pavel.mr4 — Mon, 05 Jul 2021 15:10:11 GMT

Hi,

I am trying to reach the WLC using GUI, SSH and telnet in a Flex Connect environment but i can't, tho i can ping it.

Does anybody have had any similar issue ?

BR!

Re: Can not reach the WLC using Flexconnect AP

Francesco Molino — Fri, 26 Jan 2018 15:54:45 GMT

Hi

What do you mean you can't access the wlc? Are you connected over wifi when accessing it?
Do you have local AP from which you can able to access it ?

Re: Can not reach the WLC using Flexconnect AP

pavel.mr4 — Fri, 26 Jan 2018 16:00:59 GMT

Hi Francesco,

Yes, i am trying using WIFI, I have selected the checkbox on the wlc to do that.

When I am connected to a local AP I can access the wlc without problem, but when i move to a branch office with Flex AP I cant. I wanna know if that is a normal behavior or is there any misconfiguration.

BR!

Re: Can not reach the WLC using Flexconnect AP

Francesco Molino — Fri, 26 Jan 2018 16:03:31 GMT

Ok that means you have activate mgmt-via-wireless capability.
When in Flexconnect, you said you can ping right?
If so, are there any firewalls in the path?

Re: Can not reach the WLC using Flexconnect AP

pavel.mr4 — Fri, 26 Jan 2018 16:07:49 GMT

Yup, mgmt-via-wireless capability activated.

There are no Firewalls between offices, they communicate with the sw cores

Re: Can not reach the WLC using Flexconnect AP

Francesco Molino — Fri, 26 Jan 2018 16:22:17 GMT

Just dumb question. You're trying to access the management interface right?
From the wlc, can you access remote branch devices (ping)?

Re: Can not reach the WLC using Flexconnect AP

pavel.mr4 — Fri, 26 Jan 2018 16:42:56 GMT

I have never tried that, from the wlc i can not ping the gw in the branch office.

Could be a routing issue ?

Re: Can not reach the WLC using Flexconnect AP

Saravanan Lakshmanan — Fri, 26 Jan 2018 18:12:03 GMT

don't think remote-client coming from flex-local switching enabled will have any effect on setting "network mgmt-via wireless" - As it will be considered as wired and not w.less client and its data path/acl are different from local-mode AP implementation.

Re: Can not reach the WLC using Flexconnect AP

Francesco Molino — Fri, 26 Jan 2018 19:05:07 GMT

Cab you check any acl and routing ?

Can you share a traceroute from branch and from your central site?

Re: Can not reach the WLC using Flexconnect AP

Francesco Molino — Fri, 26 Jan 2018 19:06:22 GMT

Yeah you're right, however i asked that to be sure because he can have a flexconnect ap with a central switched ssid. This is just to eliminate that part of the config

Re: Can not reach the WLC using Flexconnect AP

Francesco Molino — Fri, 26 Jan 2018 19:09:29 GMT

Also, what you can do, to validate that your issue is from your branch, is to create on this ap group a ssid centrally switched and try to access the gui or ssh. Normally it should work because when you're in your central site you said you can access your wlc.

Re: Can not reach the WLC using Flexconnect AP

pavel.mr4 — Fri, 26 Jan 2018 19:26:24 GMT

this is the output.

192.168.2.11 is the wlc

192.168.2.2 is the sw core in central office

192.168.102.6 is the sw core in branch

from central to gw, wlc and branch

SWACCESS13-MCS#ping 192.168.2.11
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.11, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/14 ms
SWACCESS13-MCS#ping 192.168.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.2.2, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 3/6/14 ms
SWACCESS13-MCS#traceroute 192.168.2.2
Type escape sequence to abort.
Tracing the route to swcore (192.168.2.2)
VRF info: (vrf in name/id, vrf out name/id)
1 swcore (192.168.2.2) 4 msec * 3 msec

SWACCESS13-MCS#traceroute 192.168.2.11
Type escape sequence to abort.
Tracing the route to 192.168.2.11
VRF info: (vrf in name/id, vrf out name/id)
1 * * *
2 * * *
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *

Tracing the route to 192.168.102.6
VRF info: (vrf in name/id, vrf out name/id)
1 swcore (192.168.2.2) 3 msec 4 msec 3 msec
2 172-10-25-4.lightspeed.rlghnc.sbcglobal.net (172.10.25.4) 3 msec 4 msec 4 msec
3 192.168.102.6 3 msec * 7 msec

from branch to cetral core and wlc

SWCORE-MCS-INFRA#traceroute 192.168.2.11

Type escape sequence to abort.
Tracing the route to 192.168.2.11

1 192.168.102.2 0 msec 0 msec 8 msec
2 172.10.25.1 9 msec 59 msec 17 msec
3 * * *
4 * * *
5 * * *
6 * * *
7 * * *
8 * * *
9 * * *
10 * * *
11 * * *
12 * * *
13 * * *
14 * * *
15 * * *
16 * * *
17 * * *
18 * * *
19 * * *
20 * * *
21 * * *
22 * * *
23 * * *
24 * * *
25 * * *
26 * * *
27 * * *
28 * * *
29 * * *
30 * * *

SWCORE-MCS-INFRA#traceroute 192.168.2.2

Type escape sequence to abort.
Tracing the route to 192.168.2.2

1 192.168.102.2 0 msec 0 msec 0 msec
2 172.10.25.1 8 msec 0 msec *

When i change Flex AP to local mode, then I can reach the WLC.

Re: Can not reach the WLC using Flexconnect AP

Francesco Molino — Fri, 26 Jan 2018 20:57:29 GMT

Ok based on outputs, you should have a firewall between branch and head office.
I guess there's a VPN built between those sites. After checking your firewalls, can you validate if there are some acl filters that would filter your WLC gui and ssh access?

Re: Can not reach the WLC using Flexconnect AP

rsayakhom — Thu, 14 Nov 2019 17:38:51 GMT

I am probably responding late to this but I an tell you I have the same issue

Local Mode no issue, Flexconnect cannot get to WLC Mgmt

I am not behind a firewall as my WLCs are internal and so is my MGMT interface, My firewalls along with most are at the parimeter so the request to reach the MGMT interface doesn't ever reach the Firewall

in short, this should NOT be a firewall issue clearly stated by the fact that simply moving the AP from Flexconnect mode to Local mode allows access and the MGMT interface or the implementation doesn't change, in both cases we still need to access the Same IP Address. What happens in Local vs Flexconnect mode is where my mind is trying to solve along with many others scratching heads wondering what's the traffic doing in both modes during the request to reach the MGMT

Re: Can not reach the WLC using Flexconnect AP

Francesco Molino — Sat, 16 Nov 2019 01:17:27 GMT

When you're connect to a local or a flexconnect AP, if you have enabled management access, you should be able to access your WLC.

The difference is your traffic is being switched locally on the switch at the branch. Are you trying to access the management interface or a dynamic interface? Can you run a wireshark and try again please? share the wireshark capture if you can please.

Re: Can not reach the WLC using Flexconnect AP

mumbles202 — Wed, 20 Nov 2019 15:15:30 GMT

The default gateway for the WLC is 2.2 (the central core switch)?

Re: Can not reach the WLC using Flexconnect AP

Francesco Molino — Sun, 24 Nov 2019 17:11:50 GMT

Can you maybe share some configs to see if something obvious is missing or badly configured?

Re: Can not reach the WLC using Flexconnect AP

Scott Fella — Sun, 24 Nov 2019 20:58:38 GMT

Can you access the wlc when you are on a wired connection which is on the same subnet as the wireless would be on? This would help isolate the issue especially if you have no issue connecting on the same subnet.

Re: Can not reach the WLC using Flexconnect AP

StevenH9608 — Fri, 20 Dec 2019 12:50:22 GMT

Did you ever figure this out? I am having the same issue. I am using flex connect, and can ping my management interface as well, but still no gui.