topic Re: Layer 2 isolation due to Multiple Anchor controllers in Wireless

Layer 2 isolation due to Multiple Anchor controllers

jbeltrame — Mon, 05 Jul 2021 07:19:14 GMT

Hello,

Just checking to see if there are 2 anchor controllers in different locations, that if client A connects to anchor controller A and client B connects to anchor controller B, will there be Layer 2 isolation between the 2 clients?

Thanks,

Jason

Re: Layer 2 isolation due to Multiple Anchor controllers

Stephen Rodriguez — Mon, 03 Mar 2014 14:53:03 GMT

It depends. I'd say yes by default, but if you allowed connectivity between the subnets...

Steve

Sent from Cisco Technical Support iPhone App

Layer 2 isolation due to Multiple Anchor controllers

jbeltrame — Mon, 03 Mar 2014 14:54:59 GMT

Thanks Stephen. They share the same subnet, and I can communicate between hosts on the same anchor, but not with a host on the other anchor. Was trying to figure out if this is by design of the technology, or if there is a setting that changes this.

Thanks,

Jason

Layer 2 isolation due to Multiple Anchor controllers

Scott Fella — Mon, 03 Mar 2014 19:43:31 GMT

If the clients are all on the same subnet, it's weird that they can't communicate, I can ask my clients to test this out. It might just be a limitation of the technology of using multiple anchors.

Thanks,

Scott

*****Help out other by using the rating system and marking answered questions as "Answered"*****

Layer 2 isolation due to Multiple Anchor controllers

Scott Fella — Mon, 03 Mar 2014 20:06:21 GMT

Well... my client was able to join the guest network and get anchored to one of the guest anchors and ping another device on a different anchor.

Thanks,

Scott

*****Help out other by using the rating system and marking answered questions as "Answered"*****

Layer 2 isolation due to Multiple Anchor controllers

Stephen Rodriguez — Mon, 03 Mar 2014 20:07:37 GMT

Jason, same subnet, different anchors? how are the anchors communitcating, thorugh a firewall?

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

Layer 2 isolation due to Multiple Anchor controllers

Ali Aqrabawi — Mon, 03 Mar 2014 21:18:53 GMT

is the network topology as this smiple sketch ?

Layer 2 isolation due to Multiple Anchor controllers

jbeltrame — Mon, 03 Mar 2014 21:21:42 GMT

yes, that is accurate. Different hosts connecting to the same SSID, but go to different anchor controllers that connect to different firewalls. I can ping everything that connects to the same anchor, but nothing that connects to the other anchor. I am wondering if its just the EoIP tunnels that is blocking that access.

Thanks,

Jason

Re: Layer 2 isolation due to Multiple Anchor controllers

Scott Fella — Mon, 03 Mar 2014 21:24:57 GMT

But the subnet is tied together correct, meaning that the users are put in the exact same layer 2 subnet in the DMZ?

Sent from Cisco Technical Support iPhone App

Layer 2 isolation due to Multiple Anchor controllers

jbeltrame — Mon, 03 Mar 2014 21:26:29 GMT

Correct, but I don't see arp or anyting from any host connected to the other anchor controller.

Layer 2 isolation due to Multiple Anchor controllers

Ali Aqrabawi — Mon, 03 Mar 2014 21:27:21 GMT

one last question just for confirmation , you have two WLANs on the forgien WLC with the same SSID , right ?

if yes , then you can replace each anchor WLC with a L2 switch and consider that the clients are directly connected to these switches , if these switches do L2 isolation between the clients , then the WLCs do .

Layer 2 isolation due to Multiple Anchor controllers

jbeltrame — Mon, 03 Mar 2014 21:40:10 GMT

the same SSID is created on the local controller and both anchor controllers.

Layer 2 isolation due to Multiple Anchor controllers

Ali Aqrabawi — Mon, 03 Mar 2014 21:48:19 GMT

ok, what i'm trying to say that if there is communication between client A and client B it's would not be through the mobility tunnels between the WLCs , it will be through the switched network .

Layer 2 isolation due to Multiple Anchor controllers

jbeltrame — Tue, 04 Mar 2014 00:24:51 GMT

Correct. I just wanted to make sure what I was seeing was sane. I thought it was because of the way EoIP and CAPWAP tunnels work. So broadcasts and such would not cross them, therefore I would only communicate to hosts that are connected to the same anchor controller via that tunnel.

thanks,

Jason

Layer 2 isolation due to Multiple Anchor controllers

Scott Fella — Tue, 04 Mar 2014 00:44:50 GMT

The anchor WLC is putting the guest in the same switched subnet correct? if so, it would be the same as if you were connected wired, you should be able to ping any device on that same layer 2 network.

Thanks,

Scott

*****Help out other by using the rating system and marking answered questions as "Answered"*****

Re: Layer 2 isolation due to Multiple Anchor controllers

jbeltrame — Tue, 04 Mar 2014 02:04:17 GMT

same subnet but different anchors in different parts of the US. so hosts local to that anchor are switched. the networks are not shared except the same L2 subnet, and the original controller. so what would have to happen is that host traffic would have to cross back over the EoIP tunnel to the internal controller, and then cross the other EoIP tunnel back to the other controller to talk to those hosts. I don't believe this is possible, but want to confirm that. this was setup by an outside consultant before I got there.

thanks,

Jason.

Sent from Cisco Technical Support iPad App