Can an Aironet WiFi Access Point bridge multiple internal VLANs?

[lmaugustin]

I have Cisco Aironet 2700e access points.  Historically they were configured with a single SSID on both radios with WEP 128bit security.

I now need to add new WiFi devices to the network that have limited flexibility.  They must be associated only with a specific radio (2.4ghz or 5ghz) and WPA2PSK security.

My thought was to create two additional SSIDs on the 2700 access points, one for 2.4gz WPA2PSK and the other for 5ghz WPA2PSK.  The pre-existing SSID will continue to use 128bit WEP.  To do that  I need to use VLANs on the 2700e.

I have no other VLANS on my network.  I only need VLANs on the 2700e because I have different physical devices that support different WiFi frequencies and security options.  I don't need to segment the network.

How do I bridge the VLANs on the 2700e?

Devices that connect to the non-native VLANs appear to be isolated from the rest of the network (as I would suspect with VLANs).  But that's not what I want .  I'm only using VLANs because I need multiple SSIDs, and I need multiple SSIDs because I have different physical devices that want different WiFI access point configurations.  I can't seem to find any way to configure the 2700e to bridge the VLANs for the multiple SSIDs.

Any guidance would be appreciated.  I could buy additional access points but that seems to be defeating the purpose of having a device like the 2700e.

Any help would be appreciated.

Thank you.

[Francesco Pettene]

Assuming that you are using autonomous AP, check the following link:

https://supportforums.cisco.com/document/55561/multiple-ssid-multiple-vlans-configuration-example-cisco-aironet-aps

What you need is propber mbssid and bridge-group configs

regards

fp

[lmaugustin]

Thank you for your help.  I am using Autonomous access points.

I have already read the example you reference.  You will note that it does the bridging using a separate MLS switch running IOS. My question was how to do the bridging using the Aironet AP.

I don't have VLANs set up anywhere else in my network.  I don't have Cisco switches at the network core.

Back to my question: can the bridging be done at the Access Point?  Can you re-write the example you reference so that it does not require the additional piece of equipment to do the bridging?

Thank you.

[lmaugustin]

I made these changes to the example here:

https://supportforums.cisco.com/document/55561/multiple-ssid-multiple-vlans-configuration-example-cisco-aironet-aps

and it seems to be working.  (By "working" I mean that I can now ping to/from devices connected on different SSIDs.) I had to make these changes from the CLI.  There does not seem to be a way to make these changes from the GUI.  Is that correct? If there is a way to make these changes from the GUI please let me know.

The changes I made were to make the sub interface for Dot11 radio 0 on the VLANs part of bridge-group 1.  So assuming the config in the example:

ap(config)#interface Dot11Radio0.2
ap(config-subif)#no bridge-group 2
ap(config-subif)#bridge-group 1
ap(config-subif)#exit
ap(config)#interface Dot11Radio0.3
ap(config-subif)#no bridge-group 3
ap(config-subif)#bridge-group 1
ap(config-subif)#exit

I did not change the bridge group on the Ethernet interface.

Questions:

1. Did I create any new problems making this change? It seems to work, but am I going to get myself in trouble somewhere else?  Intuitively it makes sense to me: the VLANs are now part of the same bridge group (1, the native VLAN).  So all traffic should be bridged together.  Correct?

2. I didn't change the Ethernet sub interfaces.  I don't seem to need to make that change.  I also don't like things sitting out there that I don't understand.  Should I do anything to clean up the Ethernet interfaces?

3. The original configuration was made entirely from the GUI.  This change needs to be made from the CLI.  Can it be done from the GUI?  I can't seem to find a way to change bridge groups for a sub interface from the GUI. It worried me that it can't be done from the GUI.

Thank you.

Larry

[Francesco Pettene]

I a previous post you're speaking about MLS switching: so you

don't need bridging, you need routing between different subnets.

The problem is, APs (and WLCs!) can not route, they're basically

switches between air and copper.

If you squeeze different bridge groups on the same one, you are

putting different corresponding subnets on the same L2 domain,

also called VLAN :-)

Though, you still need your IP packets to be routed between your

subnets and it cannot work without an MLS or an L3 device.

My suggestion is to go back to a clean config with different bridge

groups, i dont think you can get rid of your MLS.

I think the only L3 interface (bvi) is only there for control plane purposes

such as VTY, AAA, and so on, i dont think it will ever learn MAC/IP

addresses and forward traffic.

fp

[lmaugustin]

You are confused.  I don't have subnets.

Setting the bridge groups to the same group worked because the AP is a Layer 3 bridge.

Someone else must have a configuration like this.  It's just multiple SSIDs

FYI, it's easy to set this up on Netgear devices.  Not sure why it's so difficult to configure on the Cisco Aironet.

Thanks.

[Francesco Pettene]

If you dont have subnets, you clearly dont have ip addresses:

so why are you making references to layer 3?

Furthermore, if you want to put different bridge groups (vlans)

in communication beween themselves, why dont you just use only one?

fp

[lmaugustin]

> Furthermore, if you want to put different bridge groups (vlans) in

> communication beween themselves, why dont you just use only one?

You missed the whole point of my question. I need multiple SSIDs because I have physical devices that require different WiFi security settings.  The devices have limitations in their WiFi capabilities. The only way to do this on a Cisco Aironet is to assign a VLAN per SSID.  That is a limitation of how the Cisco Aironet can be configured.

Unfortunately, I then need to bridge the VLANs.  Assigning all the VLANs to the same bridge-group seems to be the way to go.

Yes, I could create multiple subnets, and then route the subnets. I shouldn't need to.  (Even the example from Cisco shows the VLANs being bridged, just at the Ethernet switch, not at the AP.)

[Francesco Pettene]

Do you mind posting your config stripping sensitive infos such as passw. and PSKs?