WLC Broadcast Forwarding Issue

[Najib Akbari]

Hi,

Hi,
I was wondering if you can help with this technical issue Im dealing for the past 3-4 days:
I have 2X WLC 5508 and 1142APs on each in two different independent locations with Identical config and image on both setups. I enabled Broadcast forwarding on both so wireless client can discover a printer with broadcast resides on the same vlan/subnet on wired. this works on one setup while the other setup is not working. I checked everything I could but were not able to resolve the issue. can you please help me with this? maybe an intermittent bug on image 8.3.150.0 or any way if you direct me to the right path to search and find. I basically compared the whole two setup and could not figure it out.

Thank you!
Najib

[balaji.bandi]

just want to check what switches they are connected  - how is switch config here ?

also can you post #Show Network Summary  (from both WLC ?)

[Najib Akbari]

I literally compared both WLCs config and switch config. I doubt if its WLC config but not sure switch config. maybe Im missing something. enabled BF on both WLCs and both are functioning in Local mode ( client traffic tunnels to WLC). in my option if some config caused this it must be switch ( trunk prt channel config are identical on both switches though ) otherwise it can be image bug. but this is just my opinion and I appreciate you guys help in this regard. Thanks!

WLC1 ( No Issue ) :

WLC connected to C9300 Stack core switch. this switch link is trunk mode on to WLC and the core switch is L3 running IP routing

(Cisco Controller) >show network summary

RF-Network Name............................. WLC1
DNS Server IP............................... 0.0.0.0
Web Mode.................................... Disable
Secure Web Mode............................. Enable
Secure Web Mode Cipher-Option High.......... Disable
Secure Web Mode SSL Protocol................ Disable
Web CSRF check.............................. Enable
OCSP........................................ Disabled
OCSP responder URL..........................
Secure Shell (ssh).......................... Enable
Secure Shell (ssh) Cipher-Option High....... Disable
Telnet...................................... Enable
Ethernet Multicast Forwarding............... Enable
Ethernet Broadcast Forwarding............... Enable
IPv4 AP Multicast/Broadcast Mode............ Unicast
IPv6 AP Multicast/Broadcast Mode............ Unicast
IGMP snooping............................... Disabled
IGMP timeout................................ 60 seconds
IGMP Query Interval......................... 20 seconds
MLD snooping................................ Disabled
MLD timeout................................. 60 seconds

--More-- or (q)uit
MLD query interval.......................... 20 seconds
User Idle Timeout........................... 600 seconds
ARP Idle Timeout............................ 600 seconds
Cisco AP Default Master..................... Disable
AP Join Priority............................ Disable
Mgmt Via Wireless Interface................. Disable
Mgmt Via Dynamic Interface.................. Disable
Bridge MAC filter Config.................... Enable
Bridge Security Mode........................ EAP
Mesh Full Sector DFS........................ Enable
Mesh Backhaul RRM........................... Disable
AP Fallback ................................ Enable
Web Auth CMCC Support ...................... Disabled
Web Auth Redirect Ports .................... 80
Web Auth Proxy Redirect ................... Disable
Web Auth Captive-Bypass .................. Disable
Web Auth Secure Web ....................... Enable
Web Auth Secure Web Cipher Option ......... Disable
Web Auth Secure Web Sslv3 ................. Disable
Web Auth Secure Redirection ............... Disable
Fast SSID Change ........................... Disabled
AP Discovery - NAT IP Only ................. Enabled
IP/MAC Addr Binding Check .................. Enabled

--More-- or (q)uit
Link Local Bridging Status ................. Disabled
CCX-lite status ............................ Disable
oeap-600 dual-rlan-ports ................... Disable
oeap local-network ......................... Enable
oeap-600 Split Tunneling (Printers)......... Disable
WebPortal Online Client .................... 0
WebPortal NTF_LOGOUT Client ................ 0
mDNS snooping............................... Disabled
mDNS Query Interval......................... 15 minutes
Web Color Theme............................. Default
Capwap Prefer Mode.......................... IPv4
Network Profile............................. Disabled
Client ip conflict detection (DHCP) ........ Disabled
Mesh BH RRM ................................ Disable
Mesh Aggressive DCA......................... Disable
Mesh Auto RF................................ Disable
HTTP Profiling Port......................... 80
HTTP-Proxy Ip Address....................... 0.0.0.0
HTTP-Proxy Port............................. 80
WGB Client Forced L2 Roam................... Disabled

--------------------------------------

WLC2 ( BForwarding Not working):

WLC connected to C9300 Stack but this stack is access switch passing thru VLANs and no routing.

(Cisco Controller) >show network summary

RF-Network Name............................. WLC2
DNS Server IP............................... 0.0.0.0
Web Mode.................................... Disable
Secure Web Mode............................. Enable
Secure Web Mode Cipher-Option High.......... Disable
Secure Web Mode SSL Protocol................ Disable
Web CSRF check.............................. Enable
OCSP........................................ Disabled
OCSP responder URL..........................
Secure Shell (ssh).......................... Enable
Secure Shell (ssh) Cipher-Option High....... Disable
Telnet...................................... Enable
Ethernet Multicast Forwarding............... Enable
Ethernet Broadcast Forwarding............... Enable
IPv4 AP Multicast/Broadcast Mode............ Unicast
IPv6 AP Multicast/Broadcast Mode............ Unicast
IGMP snooping............................... Disabled
IGMP timeout................................ 60 seconds
IGMP Query Interval......................... 20 seconds
MLD snooping................................ Disabled
MLD timeout................................. 60 seconds

--More-- or (q)uit
MLD query interval.......................... 20 seconds
User Idle Timeout........................... 600 seconds
ARP Idle Timeout............................ 600 seconds
Cisco AP Default Master..................... Disable
AP Join Priority............................ Disable
Mgmt Via Wireless Interface................. Disable
Mgmt Via Dynamic Interface.................. Disable
Bridge MAC filter Config.................... Enable
Bridge Security Mode........................ EAP
Mesh Full Sector DFS........................ Enable
Mesh Backhaul RRM........................... Disable
AP Fallback ................................ Enable
Web Auth CMCC Support ...................... Disabled
Web Auth Redirect Ports .................... 80
Web Auth Proxy Redirect ................... Disable
Web Auth Captive-Bypass .................. Disable
Web Auth Secure Web ....................... Enable
Web Auth Secure Web Cipher Option ......... Disable
Web Auth Secure Web Sslv3 ................. Disable
Web Auth Secure Redirection ............... Disable
Fast SSID Change ........................... Disabled
AP Discovery - NAT IP Only ................. Enabled
IP/MAC Addr Binding Check .................. Enabled

--More-- or (q)uit
Link Local Bridging Status ................. Disabled
CCX-lite status ............................ Disable
oeap-600 dual-rlan-ports ................... Disable
oeap local-network ......................... Enable
oeap-600 Split Tunneling (Printers)......... Disable
WebPortal Online Client .................... 0
WebPortal NTF_LOGOUT Client ................ 0
mDNS snooping............................... Enabled
mDNS Query Interval......................... 15 minutes
Web Color Theme............................. Default
Capwap Prefer Mode.......................... IPv4
Network Profile............................. Disabled
Client ip conflict detection (DHCP) ........ Disabled
Mesh BH RRM ................................ Disable
Mesh Aggressive DCA......................... Disable
Mesh Auto RF................................ Disable
HTTP Profiling Port......................... 80
HTTP-Proxy Ip Address....................... 0.0.0.0
HTTP-Proxy Port............................. 80
WGB Client Forced L2 Roam................... Disabled

-------------------------------------------

let me know if more details needed

[marce1000]

 - Ideally  and according to : https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html , you should use https://software.cisco.com/download/specialrelease/2702eede2b47a5c3bb40795bbe836af6 because aireos is getting old and the controller(s) should use the latest release supported , but in your cases that is not possible since the 1142APs can only go till 8.3.x ; in the same context and since both controller and APs are EOL/EOS and because of the business need you need to modernize you wireless infrastructure.

 M.

[Najib Akbari]

We are in the process of upgrade but it takes months and I need a solution with the existing setup

[marce1000]

               >...We are in the process of upgrade but it takes months and I need a solution with the existing setup
  Yes , but since you are unable to use the last/latest release for the 5508 with numerous bugfixes that may be a showstopper too.

 M.

[Najib Akbari]

Are you saying its high likely an image bug Im facing ?

[Rasika Nayanajith]

Enabling this feature can significantly impact your wireless performance. Since every broadcast message forwarding to WiFi clients can consume valuable airtime. Therefore monitor channel utilisation & see if your WiFi performance has been degraded. 

In large scale network it should not be enabled at all

HTH
Rasika
*** Pls rate all useful responses ***

[Najib Akbari]

I Agree! here is my scenario: I have a clover system that needs to detect Wired Printer AP700 via broadcast and thats the only way to detect the printer and unable to manually add it! So after I enable the BForwarding and able to detect the printer then afterward clover charging device does unicast communication with the printer and can disable BForwarding afterward, so this way I mitigate the negative impact on wireless setup.

right now my issue is BForwarding does not work on one setup even though image version and config are the same. I kindly request help from you guys! to TShoot and resolve, if its image bug then at least I can say we can not implement but I need to be certain about it. or maybe any switch config consideration and any thing else ? Please wireless skilled people comment on this. Thank you!

[Najib Akbari · Accepted solution]

For the the reference of people might face same issue:

I found the source of issue and resolved: the site which was not working, we were using public IP ( 172.33.x.x ) as private ( I know its wrong but its been like that before me ... and working ). I compared everything between working site and not working one and the only difference was the wireless subnet. changing it to private 172.31.x.x resolved the issue!apparently WLC drops the wireless clients broadcast packets if it sees it as public IP.

this was not easy to resolve but I'm happy it did resolve finally. Thanks everyone!

[Scott Fella]

Good to know and thanks for the follow up!