topic Re: WLC 5508 Office extend - remote LAN in Wireless

WLC 5508 Office extend - remote LAN

latintrpt — Sun, 04 Jul 2021 03:38:31 GMT

I'm confused as to how to setup the remote LAN portion of the office extend solution. Do I need to set up this remote LAN with a local interface and have it talk to the controller's internal DHCP server? Or can I set up this remote LAN and anchor it off to my internal controllers?

Thanks

WLC 5508 Office extend - remote LAN

George Stefanick — Mon, 29 Aug 2011 20:58:22 GMT

You can anchor it off your internal controllers. I have mine mapped to my wireless subnets actually.

WLC 5508 Office extend - remote LAN

latintrpt — Mon, 29 Aug 2011 21:20:50 GMT

I actually tried doing this and it didn't work. Anything else special that needs to be set up? for instance like certain data rates?

Thanks

WLC 5508 Office extend - remote LAN

latintrpt — Mon, 29 Aug 2011 21:22:54 GMT

I'm confused as to what to put for the egress interface? Would this be my management interface?

WLC 5508 Office extend - remote LAN

George Stefanick — Mon, 29 Aug 2011 21:36:54 GMT

Yea, no worries. I think we all get confused on that one as well. The egress is the traffic coming back from the anchor and the interface you want to dump that traffic on.

Example -- I have my egress pointing to an existing wireless interface (production data). This means wired clients will live and get a dhcp from my wirless production data on my foreign WLC.

Make sense?

WLC 5508 Office extend - remote LAN

latintrpt — Tue, 30 Aug 2011 13:49:56 GMT

I'm still a little confused. So would I need to create this "production data" wireless interface on my office extend controller? The reason I ask is because that would mean that I would need to trunk the VLAN on which this "production data" wireless interface sits on to my DMZ switch. On my office extend controller I only have one connection plugging into my DMZ network.

WLC 5508 Office extend - remote LAN

George Stefanick — Tue, 30 Aug 2011 14:32:24 GMT

No worries..

On your ANCHOR DMZ controller you do not create a WIRED side interface for your WIRED connection. You only create a WLAN intreface for your WIRED side connection.

Then you anchor that WLAN WIRED side back to your foreign WLC.

Think of it like this. It anchor guestm but reverse.

So the officeextends client attaches to the DMZ anchor in this example. (no wired side needed). Once the packet comes in. The DMZ anchor WLC says "hey Im anchored to this foreign controller". The DMZ then sends the client to the foreign (inside) controller. This is where you can either create a new WIRED side VLAN or use an existing WIRED side wireless vlan interface on the egress.

There seems to be a lot of questions around this process. I plan to do a step by step in the next week.

WLC 5508 Office extend - remote LAN

latintrpt — Tue, 30 Aug 2011 14:44:31 GMT

This is making more sense now. So on the foreign controller, do I need to create the same Remote LAN with the same profile name as the DMZ controller, or would I need to create a WLAN on the foreign controller?

WLC 5508 Office extend - remote LAN

George Stefanick — Tue, 30 Aug 2011 14:56:49 GMT

Cool, Im glad. Its a refresher for me too! I've had this set up for a few months now and haven't touched it ...

I think a pic is worth a thousand words. I will explain and provide pics to help..

Foreign Controller -

WLAN TAB - Create a new WLAN (GUEST LAN). Call it OE-WIRED. Then ANCHOR this WLAN to itself <~ Very Importnat

Anchor Controller - Create a new WLAM (Remote LAN). Call it OE-WIRED. Then anchor this WLAN to the foreign controller <~Very important.

Image below is Anchor DMZ WLC

Image below is foreign WLC (inside)

Make more sense now?

WLC 5508 Office extend - remote LAN

latintrpt — Tue, 30 Aug 2011 15:50:26 GMT

That's a big help but I'm still unable to pick up an IP address on my laptop or IP phone.

Here is the message I'm seeing on my DMZ controller:

*apfMsConnTask_1: Aug 30 15:48:20.201: %APF-1-CONFLICT_IN_ASS_REQ: apf_80211.c:4376 Conflicting Supported Rates in Association Request from70:5a:b6:af:64:91

-Traceback: 10949a28 1094ec10 10779f38 116852e0 116eac4c

WLC 5508 Office extend - remote LAN

George Stefanick — Tue, 30 Aug 2011 15:58:03 GMT

To keep things simple.

Do you have a 1 to 1 anchor with a foreign - anchor controller? Or do you have mutliple anchors from teh DMZ to foreign controller(s)?

On your foreign controller. You created a GUEST LAN. What is your ingress and egress confgiured as? On your ingress pick NONE.

WLC 5508 Office extend - remote LAN

George Stefanick — Tue, 30 Aug 2011 15:58:51 GMT

BTW -- Are you testing WIRELESS or WIRED ... right now?

WLC 5508 Office extend - remote LAN

latintrpt — Tue, 30 Aug 2011 16:09:40 GMT

I have a a 1 to 1 anchor to foreign controller. On my foreign controller I have ingress to none and egress: production

WLC 5508 Office extend - remote LAN

latintrpt — Tue, 30 Aug 2011 16:10:11 GMT

I'm testing wired right now, that's the message I'm getting:

*apfMsConnTask_1: Aug 30 15:48:20.201: %APF-1-CONFLICT_IN_ASS_REQ: apf_80211.c:4376 Conflicting Supported Rates in Association Request from70:5a:b6:af:64:91

-Traceback: 10949a28 1094ec10 10779f38 116852e0 116eac4c

Re: WLC 5508 Office extend - remote LAN

George Stefanick — Tue, 30 Aug 2011 16:17:23 GMT

Lets confirm a few items first:

ANCHOR DMZ WLC...

You have a a WLAN called OE-WIRED (Exmaple).

It is confired for REMOTE LAN

Security Policy is None

It is anchored to the inside foreign WLC ONLY. And not to ltself ..

EGRESS is set with managment interface

FOREIGN WLC

You have a WLAN called OE-WIRED (Exmaple)

It is confgiured as a GUEST LAN

Security Policy is NONE

It is anchored to ITSELF and NOTHING else

Ingress is none

Egress is set to an exsiting WIRED side interface (tested and known working) correct ?

Also your profile name is the same, correct ? Not sure if it has to be.. but for our sake lets make sure they are ..

WLC 5508 Office extend - remote LAN

latintrpt — Tue, 30 Aug 2011 16:24:31 GMT

On ANCHOR DMZ WLC...

I have a WLAN called OE-WIRED

It is configured as a REMOTE LAN

Security Policy: None

It is anchored to a 1 foreign controller and not to itself.

EGRESS: Mangement

On FOREIGN WLC...

I have a WLAN called OE-WIRED

It is configured as GUEST LAN

Security Policy: None

It is anchored to itself and nothing else

INGRESS: None

EGRESS: is set to an exisiting WIRED side interface test and working

Profile name is the same and correct.

WLC 5508 Office extend - remote LAN

George Stefanick — Tue, 30 Aug 2011 16:26:41 GMT

Ok ...

When you look at the anchors do they show up and up on both side?

Is there a firewall between them?

Did you configure AP groups ?

WLC 5508 Office extend - remote LAN

George Stefanick — Tue, 30 Aug 2011 16:32:32 GMT

on the foreign WLC do a:

>show guest-lan X

on the anchor WLC do a:

show remote-lan X

X = the number of your interface ...

Post what you have for both ..

WLC 5508 Office extend - remote LAN

latintrpt — Tue, 30 Aug 2011 16:39:54 GMT

both the DMZ anchor controller and foreign controller show UP and UP between them.

No firewall in between them.

I did configure AP groups, but I have included OE-WIRED in the AP group for my office extend AP's.

The funny part is that when I take the AP 600 home with me, my other wireless SSID's I have broadcasted are working and I can pick up an IP off a foreign controller, so anchoring is working there. It's just with the wired port it is not working.

WLC 5508 Office extend - remote LAN

latintrpt — Tue, 30 Aug 2011 16:41:58 GMT

DMZ ANCHOR CONTROLLER:

(Cisco Controller) >show remote-lan 2

Remote LAN Identifier............................ 2

Profile Name..................................... OE-WIRED

Status........................................... Enabled

MAC Filtering.................................... Disabled

AAA Policy Override.............................. Disabled

Maximum number of Associated Clients............. 0

Number of Active Clients......................... 0

Exclusionlist.................................... Disabled

Session Timeout.................................. Infinity

Webauth DHCP exclusion........................... Disabled

Interface........................................ management

Remote LAN ACL................................... unconfigured

DHCP Server...................................... Default

DHCP Address Assignment Required................. Disabled

Radius Servers

Authentication................................ Disabled

Accounting.................................... Disabled

Dynamic Interface............................. Disabled

Local EAP Authentication......................... Disabled

Security

--More-- or (q)uit

802.11 Authentication:........................ Open System

Static WEP Keys............................... Disabled

802.1X........................................ Disabled

Wi-Fi Protected Access (WPA/WPA2)............. Disabled

CKIP ......................................... Disabled

Web Based Authentication...................... Disabled

Web-Passthrough............................... Disabled

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------

FOREIGN CONTROLLER:

(Cisco Controller) >show guest-lan 2

Guest LAN Identifier............................. 2

Profile Name..................................... OE-WIRED

Status........................................... Enabled

AAA Policy Override.............................. Disabled

Network Admission Control

Radius-NAC State............................... Disabled

SNMP-NAC State................................. Disabled

Quarantine VLAN................................ 0

Maximum number of Associated Clients............. 0

Number of Active Clients......................... 0

Exclusionlist.................................... Disabled

Session Timeout.................................. Infinity

CHD per WLAN..................................... Enabled

Webauth DHCP exclusion........................... Disabled

Interface........................................ rumcwireless

Multicast Interface.............................. Not Configured

Ingress Interface................................ unconfigured

WLAN ACL......................................... unconfigured

DHCP Server...................................... Default

--More-- or (q)uit

Static IP client tunneling....................... Disabled

Quality of Service............................... Silver (best effort)

Radius Servers

Authentication................................ Disabled

Accounting.................................... Disabled

Security

Web Based Authentication...................... Disabled

Web-Passthrough............................... Disabled

Conditional Web Redirect...................... Disabled

Splash-Page Web Redirect...................... Disabled

Auto Anchor................................... Enabled

Call Snooping.................................... Disabled

Roamed Call Re-Anchor Policy..................... Disabled

SIP CAC Fail Send-486-Busy Policy................ Enabled

SIP CAC Fail Send Dis-Association Policy......... Disabled

Band Select...................................... Disabled

Load Balancing................................... Disabled

Mobility Anchor List

GLAN ID IP Address Status

------- --------------- ------

2 172.xx.x.xx Up