topic Re: Cisco Flex Connect and users can not get IP Address by WAN in Wireless

Cisco Flex Connect and users can not get IP Address by WAN

ivan.martin — Sun, 04 Jul 2021 05:44:44 GMT

Hello my name is Ivan

I have a wlc 5508 with license base to 50 aps, i use a deployment flex connect. I already registered all my access points, I use web authentication to authenticate users guest, and the service dhcp is in the central site.

My issue is the users in each remote site, can not get an ip address by dhcp from the central site, they can authenticate in the guest ssid, but any users can not get an ip.

The request is passing by the wan in this way

Central Site DHCP - Router WAN - Remote Site - Users with notebooks. I use flex connect central deployment (all the traffic consulting to the wlc) .

perhaps i should use local deploy? The wlc is in the central site.

Can you help me to resolving this issue please? , perhaps any advice?

Regards

Ivan.

Re: Cisco Flex Connect and users can not get IP Address by WAN

Scott Fella — Sun, 30 Sep 2012 19:59:47 GMT

Is the SSID in central or local switching?

Sent from Cisco Technical Support iPhone App

Re: Cisco Flex Connect and users can not get IP Address by WAN

ivan.martin — Sun, 30 Sep 2012 20:10:42 GMT

Hello Scot Fella

Is Local swithing.

thanks for your answer

Any advice?

Regards

Re: Cisco Flex Connect and users can not get IP Address by WAN

Scott Fella — Sun, 30 Sep 2012 20:14:54 GMT

So local switching means the subnets the clients will get needs to be created at the site the WLC is located. The WLC also needs to have a dynamic interface on those subnet. Is this how you have things setup.

Sent from Cisco Technical Support iPhone App

Re: Cisco Flex Connect and users can not get IP Address by WAN

grabonlee — Sun, 30 Sep 2012 20:28:54 GMT

Ivan,

FlexConnect local switching is not ideal for the guest user setup. I would suggest you stick to central switching. Local switching means that the packets are switched locally, and with your guest anchored centrally at the WLC, your configuration has to be central switching.

Cisco Flex Connect and users can not get IP Address by WAN

ivan.martin — Sun, 30 Sep 2012 20:29:26 GMT

Hi Scott thanks for your answer

I just only configure 3 interfaces, management service port and virtual interface. The server dhcp is in each remote site. For example,

Remote Site A:

Service DHCP

Access Point Flex Connect, connecting with trunk link toward switch core

Each remote site have its own internet

The vlan id is the same in each remote site and with the same network

The broadcast dhcp is local

How can I should configure according your advice?

Regards

Ivan

Cisco Flex Connect and users can not get IP Address by WAN

ivan.martin — Sun, 30 Sep 2012 20:31:21 GMT

Thanks Osita

In your case, if I configure central flex connect, when Should I configure the Server dHCP? In the central site?

Is possible that the users in each remote site get different ip address?

Regards

Ivan

Cisco Flex Connect and users can not get IP Address by WAN

grabonlee — Mon, 01 Oct 2012 00:00:41 GMT

As long as you don't enable local switching on the SSID, traffic will be centrally switched. You can create a single dhcp scope for all guests at the central site or you create a separate scope. That means for separate dhcp, each site will have a different ssid.

Cisco Flex Connect and users can not get IP Address by WAN

ivan.martin — Mon, 01 Oct 2012 00:08:08 GMT

Hello Osita

Thanks for your answer.

Please could you give an example about your advice?. The link between the access point and the swithc is trunk passing the vlan.

I confuse about how should I configure the wlc interfaces to each ssid or mapping all the vlans using central switching

Thanks

Ivan

Re: Cisco Flex Connect and users can not get IP Address by WAN

Scott Fella — Mon, 01 Oct 2012 01:23:21 GMT

Like I mentioned, if you want client traffic at the remote site, you need I enable local switching. If you have the WLAN as centrally switched, you need I define the subnets at the site the WLC is at. With local switching enabled, you can define the WLAN to vlan mapping on each ap. it's a different configuration than local or central switched APs.

Sent from Cisco Technical Support iPhone App

Re: Cisco Flex Connect and users can not get IP Address by WAN

Scott Fella — Mon, 01 Oct 2012 01:25:09 GMT

Take a look at this link as it will explain the difference and what you need to do to make it work.

http://www.cisco.com/en/US/products/ps11635/products_tech_note09186a0080b7f141.shtml

Sent from Cisco Technical Support iPhone App

Re: Cisco Flex Connect and users can not get IP Address by WAN

grabonlee — Mon, 01 Oct 2012 08:35:45 GMT

In addition to the link Scott posted. Since you mentioned guest services, also use the link below:

http://www.cisco.com/en/US/docs/solutions/Enterprise/Mobility/emob41dg/ch10GuAc.html

Another link for flexconnect is:

http://www.cisco.com/en/US/docs/wireless/controller/7.2/configuration/guide/cg_flexconnect.html

Re: Cisco Flex Connect and users can not get IP Address by WAN

ivan.martin — Mon, 01 Oct 2012 16:51:23 GMT

Hi Osita, thanks for your advice

In the case all the guest in remote sites have the same network but with different vlan id, i believe that i should use central swithing, with own service dhcp getting the ip address.

Is correct that?

Ivan

Re: Cisco Flex Connect and users can not get IP Address by WAN

grabonlee — Tue, 02 Oct 2012 08:13:42 GMT

Hi Ivan

For guest users, I suggest you keep it simple.

1. Create a single dhcp scope at the central site, preferably on the WLC which I hope is on your DMZ. Limit the lease time to 30mins or less, so that outsiders do not hold on to IP addresses for a long time and hence fill up your scope.

2. Use central switching and not local switching on the WLAN SSID.

Re: Cisco Flex Connect and users can not get IP Address by WAN

ivan.martin — Tue, 02 Oct 2012 16:49:22 GMT

Thanks Osita

If I configure Central Authentication and I configure central switching I need to create a dynamic interafce for each remote site and each dynamic interface associated with a different VLAN ID, because I can not associate a single interface dynamic to the same VLAN ID, but in my case the client remote in each remote site have the same network segment with the same VLAN ID with the same SSID for guests. My goal is to configure web authentication with the local DHCP server at each remote site, will this work?.Each remote site have its own server dhcp.

If I configure authentication central authentication with central switching with web authenticacion as I set in my scenario?

My issues are the interfaces dynamics, because I have the same network to the customer guest with the same ID VLan in each remote site

Regards

Re: Cisco Flex Connect and users can not get IP Address by WAN

grabonlee — Tue, 02 Oct 2012 18:20:01 GMT

A network diagram would help make it clearer what you want to achieve. What is your set up?

1. Is the WLC solely for guest access and the APs only broadcasting the guest SSID? or

2. are their 2 WLCs with one acting as the anchor for guest users?

You can configure different dynamic interfaces with its vlan ID for each site and the external dhcp IP address is specified on the each dynamic interface. Also the DHCP server has to be reachable from the WLC. You can ping the dhcp servers from the WLC to confirm reachability.

Re: Cisco Flex Connect and users can not get IP Address by WAN

ivan.martin — Tue, 02 Oct 2012 21:45:32 GMT

Thanks Osita

I have

One WLC in the central site

Server DHCP in the central site, it can send the ip address to all the customer are in the remote Sites

3 SSID

Corporative with 802.1x peap

Directors with wpa psk with mac filtering

Guest with Web Authentication

I each remote site have a router wan, it can work that server dhcp to all the customer

Each remote site have the same network: 192.168.1.0/24 in the same vlan id 30

My issue is:

I shold deploy central authentication with central swithing or local switching?

If I configure central switching, i should configure interfaces dynamics for each remote site, but each network remote site and id vlan are the same.

How can I do iT?. I think that central authentication with local swithing can work very well in my scenary.

Whats your opinion?

Regards

Ivan

Re: Cisco Flex Connect and users can not get IP Address by WAN

grabonlee — Wed, 03 Oct 2012 10:30:26 GMT

It's not best practice to have both your corporate clients and guests anchored on the same WLC. However, for your scenarion,I would suggest the following:

1. Disable LAG on the WLC if it exits

2. Create a dynamic vlan for guests and map it to a physical port on the controller. The WLC 5508 has 8 distribution ports so there is enough.

3. Your corporate clients SSID can be mapped to the management interface if you choose. The management interface takes the first port.

4. The dynamic interface for the guests must have the IP address of the external dhcp server specified.

5. If the WLC ports are connected to the same switch, you can create pre-authemtication ACL for guests to deny access to any corporate subnets and allow connection to only DNS,DHCP,and other necesssary services.

6. Map the guest SSID to the dynamic interface VLAN.