topic MAC-address leakage between VLANs/SSIDs in Wireless

MAC-address leakage between VLANs/SSIDs

magnus.maatta — Sun, 04 Jul 2021 06:44:03 GMT

Hi,

I'm having a problem with MAC-addresses being leaked between different SSIDs on different VLANs, so that our clients will be unreachable as the systems will get the wrong MAC-address for the IP-address requested.

We're trying to connect a number of industrial systems through wifi with autonomous access points configured as WGB's and

have setup 8 SSIDs (system1, system2, system3 etc) on different VLANs (701,702,703, ...) and as with most industrial systems

they are using the same IP-range and IP-addresses for the systems, so the security PLC have f.e. 10.10.10.102 on system1, system2 etc.

We have tried different ways trying to trick the WLC into not mixing them up between the SSID:s and VLANs without any positive result.

We tried tunneling all the traffic through the unified VLAN client feature but got the same result. However we got it working momentarily by

setting IP 10.10.10.129 on one device, then changing it to the correct one after the ARP-tables had been filled on the clients with the correct

ones, but this only worked until either IAPP or the ARP-cache on either the WGB or the WLC (not sure which one) timed out or some timer

kicked in and removed the correct MAC-address and added the MAC-address from another SSID/VLAN for that IP-address on that net.

Since the security PLC's need <100ms delay between each other (the wired one and the one behind the WGB) trying to do some workaround

with IP-addresses is impossible.

Equipment used:

1262 APs as WGB, tried with the following IOS versions: 12.4(25d)-JA1/2, 15.2-2JA and JB, we also tried with a 3602.

5508 WLC: tried with following IOS versions: latest 7.0, latest 7.2 and latest 7.4

1262 LAPs are used for distributing the SSID:s

We have Passive Client enabled on all the SSID:s with unicast multicast mode set on controllers.

Unified VLAN WGB feature enabled on controllers.

Anyone got any solution to our problem ?

MAC-address leakage between VLANs/SSIDs

Amjad Abdullah — Sat, 16 Mar 2013 09:06:27 GMT

Magnus:

I think we need more elaboration from your side.
What I understood is that you have 8 VLANs (8 SSIDs) and those VLANs configured on a switch which has a WGB connected to it that bridges the wireless traffic. The VLANs are configured correctly on the switch, WGB and WLC.

You have some clietns on VLAN 701 for example get connected to different VLANs (say 703).? Is that what happen? Please elaborate more abit.

Regards,

Amjad

Rating useful replies is more useful than saying "Thank you"

MAC-address leakage between VLANs/SSIDs

magnus.maatta — Mon, 18 Mar 2013 07:33:23 GMT

Almost, I should have written a bit more exact description, sorry about that.

We have one WGB connected to ssid1 on vlan 701 and another WGB connected to ssid2 on vlan 702, another connected to ssid5 on vlan 705.

And as I said, the clients behind the WGBs and on the wired net all have the same IP addresses on their respective VLAN.

MAC-address leakage between VLANs/SSIDs

Amjad Abdullah — Mon, 18 Mar 2013 07:47:40 GMT

And as I said, the clients behind the WGBs and on the wired net all have the same IP addresses on their respective VLAN.

I am still not able to understand what that mean.

It looks to me like you say client X has same exact ip as Clien Y but client X and client Y are in two different VLANs. (but I don't think this is the situation). Please elaborate more.

Rating useful replies is more useful than saying "Thank you"

MAC-address leakage between VLANs/SSIDs

magnus.maatta — Mon, 18 Mar 2013 08:14:41 GMT

Clients behind WGBs:

Client A1 on ssid1 with ip 10.10.10.19

Client B1 on ssid2 with ip 10.10.10.19

Client C1 on ssid4 with ip 10.10.10.19

Clients on wired net:

Client A2 on VLAN 701 with ip 10.10.10.39

Client B2 on VLAN 702 with ip 10.10.10.39

Client C2 on VLAN 704 with ip 10.10.10.39

All clients with netmask 255.255.255.0

It works for about 15 seconds before it stops working (the communication between clients), after that it will stop

working and the arp tables on the clients will have the MAC address for another client on a different SSID/VLAN.

MAC-address leakage between VLANs/SSIDs

Amjad Abdullah — Mon, 18 Mar 2013 08:22:43 GMT

Magnus:
Your clients connected directly to the WGB? (one client per WGB) or the WGBs connected to a switch and the other clients connected to same switch?

if WGBs uses switches, all WGBs connected to same switch? or different switches?

AFAI understood from your description, you have two different clients with same IP on same VLAN. This design doesn't really work. You have to change the design to have unique ip addresse for clients on same VLAN. This should be the solution for your issue.

If I mis-understood something I am waiting for your elaboration.

Greetings,

Amjad

Rating useful replies is more useful than saying "Thank you"

MAC-address leakage between VLANs/SSIDs

magnus.maatta — Mon, 18 Mar 2013 08:37:50 GMT

The clients that have the same IP addresses are separated from each other on different VLANs, which is the reason I separated the different ones by using A1, A2, B1, B2.

So the A-clients are on ssid1 which is a VLAN interface on the controller with VLAN ID 701.

The B clients are on ssid2 which is VLAN ID 702.

C are on ssid4 which is VLAN ID 704.

Right now, we only have one client connected directly to the WGB and one client on the wired network, same switch as the controller is connected to.

MAC-address leakage between VLANs/SSIDs

magnus.maatta — Mon, 18 Mar 2013 08:41:00 GMT

Client A1, B1, C1 each have a WGB which connects them to the correct ssid, ssid1 for A1, ssid2 for B1 and ssid4 for C1.

MAC-address leakage between VLANs/SSIDs

Amjad Abdullah — Mon, 18 Mar 2013 08:46:24 GMT

Magnus:

How you have different dynamic VLAN interfaces with same IP subnet range? This is not possible on cisco wireless controller!!

You have SSID1 on 10.10.10.x

you have SSID2 on 10.10.10.x as well.

This is not possible on cisco WLC.

There is possibly something missing or something that I don't understand.

Rating useful replies is more useful than saying "Thank you"

MAC-address leakage between VLANs/SSIDs

magnus.maatta — Mon, 18 Mar 2013 09:00:47 GMT

The controllers use some other "dummy" IP 192.168.10Y.1X, Y is 1 for ssid1, 2 for ssid2 etc, X is just the controller number from 1 to 6.

We're only trying to bridge the clients behind the WGB to the wired net through wifi

MAC-address leakage between VLANs/SSIDs

Amjad Abdullah — Mon, 18 Mar 2013 09:05:16 GMT

Magnus:

So, you have multiple controllers?

I am still confused. I think one logical diagram shows the connection worths 1000 words.

Rating useful replies is more useful than saying "Thank you"

MAC-address leakage between VLANs/SSIDs

magnus.maatta — Mon, 18 Mar 2013 09:34:12 GMT

Image which might clarify the setup. Only with one controller, as both lightwieght APs are connected to the same controller. We tried with different controllers for the APs with different SSIDs, but that didn't help.

MAC-address leakage between VLANs/SSIDs

Amjad Abdullah — Mon, 18 Mar 2013 10:03:35 GMT

Magnus:

Thank you for the great diagram.

Now, I still believe you should not use the 192.168.x.x on same VLAN where the 10.10.10.x subnet is being used. You need to have the dynamic interface on same subnet as the VLAN subnet. This will force you to use different subnets for both SSIDs. This is what all cisco docs recommend. violating that will obviously causes abnormal behavior (just like your current situation).

Rating useful replies is more useful than saying "Thank you"

MAC-address leakage between VLANs/SSIDs

magnus.maatta — Mon, 18 Mar 2013 10:34:28 GMT

Yeah but we can't use the same IP-net on several different SSID's on the controller.

As I said in the original post, the clients are part of an industrial system and it's not possible to use different IP-addresses and/or subnets for the clients.

MAC-address leakage between VLANs/SSIDs

Amjad Abdullah — Mon, 18 Mar 2013 10:46:24 GMT

You can do some workarounds (not sure if the fit in your situation) like using same dynamic interface for different SSIDs.

You may need to bring separate WLC if you insist on same IP addressing.

I am sorry I am trying my best to help but the current design is not as good as we can offer useful solutions.

Regards,

Amjad

Rating useful replies is more useful than saying "Thank you"

Re: MAC-address leakage between VLANs/SSIDs

magnus.maatta — Mon, 18 Mar 2013 11:34:32 GMT

We tried moving one of the LWAPP's to another controller, but that didn't help, probably because they're in the same mobility group.

If we add the MAC-address and IP-address for the devices via macfilter, it will work. However, this doesn't work in reality as it will be too much administration as the system might move from ssid1 to ssid4 (by switching the WGB connected to the industrial system).

Also, if technicians have to change some part of the industrial system because of broken parts they have to contact a communication technician who will have to update the macfilter, remove the old one, add the new one.

If a system is changing from ssid1 to ssid4, all MAC-addresses and IP-addresses in the macfilter will have to be changed also.

MAC-address leakage between VLANs/SSIDs

Amjad Abdullah — Mon, 18 Mar 2013 12:15:44 GMT

That is what I am saying. Good design from first step would have saved us a lot of efforts now.

Rating useful replies is more useful than saying "Thank you"

Re: MAC-address leakage between VLANs/SSIDs

magnus.maatta — Mon, 18 Mar 2013 12:58:28 GMT

Yeah but unfortunately, all industrial systems seem to be designed in the beginning of the 90's or so and still use the same design..