ASK Access Point Can Not Join to WLC on Border

[febryoponcosulistyo]

Dear Cisco Community,

Kindly ask, I have this topology for PoC SDA

the issue that I am facing the AP can not join to WLC and WLC looopback can not reach DNAC (even all the other's Loopback are able to reach DNAC) 

Please kindly need your help and suggestion

P.S:since it is on customer side I will share the config by direct message

Thank you

[Scott Hodgdon]

@febryoponcosulistyo ,

This sounds like a routing issue between DNAC and WLC. Why not put the WLC in the DC in same subnet as ISE and DNAC ? 

As for AP not getting to the WLC, is the AP subnet in the INFRA_VN ?

I would highly recommend watching the session "BRKEWN-2021 : How to setup SDAccess from scratch" in the On-Demand Library at https://www.ciscolive.com/global/on-demand-library.html. It is mostly a demo, so you can fast forward the video as needed. 

Although it is from Oct2019 and does not have the new GUI screens, this document should be helpful as well : https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/Campus/sda-fabric-deploy-2019oct.pdf . Of particular note is this Tech Tip on Page 67:

A default route in the underlay cannot be used by the APs to reach the WLC. A more specific route (such as a /24 subnet or /32 host route) to the WLC IP addresses must exist in the global routing table at each node where the APs connect to establish connectivity

Hope that helps.

Cheers,
Scott Hodgdon

Senior Technical Marketing Engineer

Enterprise Networking and Cloud Group

[febryoponcosulistyo]

Hi Scott,

Thank you for your kind answer

The design is coming from customer they need to be in same area with the AP.

So we should put specific route for the every border and edge to reach the WLC, shouldn't we?

cmiiw

Thank you

[Scott Hodgdon]

@febryoponcosulistyo ,

The note indicates that the more specific route must exist on the nodes where the APs are connected, this would be the Fabric Edges. The Borders will not have APs connected to them.

In the design you are showing there is one area of caution. If someone from a user VN wants to connect to the WLC for management purposes (such as a member of IT staff), this would require either leaking between the user VN and the GRT on the Border (which is not recommended) or it would require the traffic to go to the Fusion and then come back down to the Border to go to the WLC (and thus creating a traffic hairpin). To avoid these two sub-optimal / unrecommended situations, it would be better to put the WLC directly off the Fusion if possible.

Cheers,
Scott Hodgdon

Senior Technical Marketing Engineer

Enterprise Networking and Cloud Group

[rasmus.elmholt]

You should at least make sure the subnet the WLC is configured on and maybe its Lo0 address is in the routing table of all the fabric nodes in the GRT(isis).

Is the WLC configured on a port manually in the Global Routing Table on B1 or is it connected via L2 handoff?