Hi,
We are trying to set up a Wired Guest Access solution based on the infrastructure:
- Converged access (sup8/3850) as Mobility Agent (MA)
- CT-5508 as Mobility Controller (MC)
- CT-5508 as Mobility Anchor (on DMZ)
There is a Switch Peer Group (SPG) on the MC for the sup8/c3850 and the link between MA/MC and between SPG members is up, so no problems there at this moment.
The issue is that we cannot establish the tunnel for the Wired Guest Access, from the MA to the anchor, we keep on receiving these messages on the MA:
Aug 12 08:00:42.463: epm_spi_client_tunnel_add:server
Aug 12 08:00:42.463: Sending tunnel add request to WCM for server_handle 3100004B, server_rh 7A000053, mac 0023.ebc8.92d6, audit_ses_id 0A8320080000101DD2318554, profile name TUNNEL-CAPWAP, src intf 0x101A4000000015A, client iif id 0x100E080000002D9, client hdl 74000010
Aug 12 08:00:42.463: EPM_SESS_EVENT: Feature (EPM Tunnel Feature PLUG-IN) identity has been updated (status 1)
Aug 12 08:00:42.464: spi_epm_wired_tunnel_wcm_epm_response_handler
Aug 12 08:00:42.464: tunnel add failed
Aug 12 08:00:42.464: EPM_SESS_EVENT: Feature (EPM Tunnel Feature PLUG-IN) Status (2) Notified
Aug 12 08:00:42.464: EPM_SESS_EVENT: Failed feature attrs provided for EPM Tunnel Feature PLUG-IN
Software versions:
- Sup8: 03.07.01E
- c3850: 03.06.02a.E
- CT-5508: 7.6.130.0
Relevant config on sup8
wireless mobility controller ip <CT-5508 MC IP> public-ip <CT-5508 MC IP>
!
guest-lan WIRED-GUEST 1
shutdown
client vlan 10
mobility anchor <CT-5508 anchor IP>
no security web-auth
no shutdown
!
service-template GUEST-TUNNEL
tunnel type capwap name TUNNEL-CAPWAP
!
policy-map type control subscriber TUNNELLED-GUEST
event session-started match-all
1 class DOT1X-NO-RESP do-until-failure
1 activate service-template GUEST-TUNNEL
!
vlan 10
name GUEST
exit
!
access-session tunnel vlan 10
!
interface GigabitEthernet2/1
description *** Phone + Laptop
switchport access vlan 5
switchport mode access
switchport nonegotiate
switchport voice vlan 6
access-session host-mode multi-domain
access-session port-control auto
dot1x pae authenticator
dot1x timeout tx-period 6
dot1x timeout supp-timeout 6
spanning-tree portfast
service-policy type control subscriber TUNNELLED-GUEST
Relevant config on CT-5508 MC
Enable New Mobility(Converged Access)
SPG and SPG members
Relevant config on CT-5508 Anchor
Enable New Mobility(Converged Access)
Guest LAN WIRED-GUEST
Has anyone done this type of setup?
