Nexus Core Switch

[mathemba]

Good Day All,

We have a huge problem that might be small to some of you.

We have a nexus core switch which has the following configs;

interface Vlan3
vrf member Trust
ip address 10.10.3.1/24
ip dhcp relay address 10.10.4.20
description Wireless_Manag
no shutdown

That vlan is specifically reserved for Cisco Access Points and is defined on the DHCP. We also have Cisco ISE in the mix. Because our AP's are growing day by day we needed to create a new scope (10.11.0.0/22), which will be reserved for AP IP addresses. We changed the configs on the core switch from 10.10.3.1/24 to 10.11.0.1/22 and created the scope on a Windows Server 2012 virtual machine. When we rebooted the AP's, they all came up with the new address but the SSID on our network disappeared.

Please help!!!

[marce1000]

 - If this is a controller  based setup ; are they still finding the wireless controller and or joining it ?

M.

[mathemba]

Yes we have a Cisco 8500 series WLC and no they do not join. Attached is the access list on the WLC.

[marce1000]

 - If they no longer join  you have to resolve the in-between networking problem and or connectivity between the AP-network and the controller. You may also remove the access list, as an 'easy starter' for testing.

M.

[Sergey Lisitsin]

mathemba,

As i don't see any routing config under the interface, I presume your routing subnets are defined under the routing process, whichever one you use. When you changed the IP address of the VLAN interface on the switch, did you also include new network into your dynamic routing protocol?

[mathemba]

We do not have any routing, its pure layer 2.

[Sergey Lisitsin]

Mathemba, in that case, you must have your wireless controller in the same subnet, right? Have you changed it's IP address?

[mathemba]

Wireless controller has always been on the 10.10.2.0/24 subnet, and the AP's on 10.10.3.0/24 and all was working fine.

[Sergey Lisitsin]

mathemba,

In that case, there must have been routing between the APs subnet and the wireless controller's subnet. It couldn't have been pure layer 2 network, if they were in different subnets. Now, if the network where controller resides also exist on the same switch and controller uses this switch as a default gateway, there is no issue. But if controller is in a remote network and you rely on dynamic routing to get to it, then you have an issue of not advertising your new subnet for wireless APs to the controller.

[Leo Laohoo]

---

@mathemba wrote:

Wireless controller has always been on the 10.10.2.0/24 subnet, and the AP's on 10.10.3.0/24 and all was working fine.

---

I am not talking about the WLC management IP address.  Nor am I interested at the APs IP address. 

I am want to know more about the Dynamic Interface where the SSID is pointing to.

Post the complete output to the command "sh wlan <SSID ID number>".

[mathemba]

(Cisco Controller) >show wlan 1


WLAN Identifier.................................. 1
Profile Name..................................... UMP-WiFi
Network Name (SSID).............................. UMP-WiFi
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Enabled
Network Admission Control
Client Profiling Status
    Radius Profiling ............................ Disabled
     DHCP ....................................... Disabled
     HTTP ....................................... Disabled
    Local Profiling ............................. Enabled
     DHCP ....................................... Enabled
     HTTP ....................................... Enabled
  Radius-NAC State............................... Enabled
  SNMP-NAC State................................. Disabled
  Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Maximum number of Clients per AP Radio........... 200

--More-- or (q)uit
ATF Policy....................................... 0
Number of Active Clients......................... 330
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 1800 seconds
User Idle Timeout................................ Disabled
Sleep Client..................................... disable
Sleep Client Timeout............................. 720 minutes
User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... none
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ umpwifi
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
WLAN Layer2 ACL.................................. unconfigured
mDNS Status...................................... Enabled
mDNS Profile Name................................ default-mdns-profile
DHCP Server...................................... Default
DHCP Address Assignment Required................. Enabled
Static IP client tunneling....................... Disabled
Tunnel Profile................................... Unconfigured
PMIPv6 Mobility Type............................. none

--More-- or (q)uit
    PMIPv6 MAG Profile........................... Unconfigured
    PMIPv6 Default Realm......................... Unconfigured
    PMIPv6 NAI Type.............................. Hexadecimal
    PMIPv6 MAG location.......................... WLC
Quality of Service............................... Platinum
Per-SSID Rate Limits............................. Upstream      Downstream
Average Data Rate................................   0             0
Average Realtime Data Rate.......................   0             0
Burst Data Rate..................................   0             0
Burst Realtime Data Rate.........................   0             0
Per-Client Rate Limits........................... Upstream      Downstream
Average Data Rate................................   0             0
Average Realtime Data Rate.......................   0             0
Burst Data Rate..................................   0             0
Burst Realtime Data Rate.........................   0             0
Scan Defer Priority.............................. 3,4,5
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Disabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled

--More-- or (q)uit
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... 802.1P (Tag=5)
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
   Authentication................................ 10.10.2.18 1812 *
   Authentication................................ 10.10.2.19 1812 *
   Accounting.................................... 10.10.2.18 1813 *
   Accounting.................................... 10.10.2.19 1813 *
      Interim Update............................. Enabled
      Interim Update Interval.................... 0
      Framed IPv6 Acct AVP ...................... Prefix
   Dynamic Interface............................. Disabled
   Dynamic Interface Priority.................... wlan
Local EAP Authentication......................... Disabled
Radius NAI-Realm................................. Disabled
Mu-Mimo.......................................... Enabled
Security

   802.11 Authentication:........................ Open System

--More-- or (q)uit
   FT Support.................................... Disabled
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Enabled
      WPA (SSN IE)............................... Disabled
      WPA2 (RSN IE).............................. Enabled
         TKIP Cipher............................. Disabled
         AES Cipher.............................. Enabled
      OSEN IE.................................... Disabled
      Auth Key Management
         802.1x.................................. Enabled
         PSK..................................... Disabled
         CCKM.................................... Disabled
         FT-1X(802.11r).......................... Disabled
         FT-PSK(802.11r)......................... Disabled
         PMF-1X(802.11w)......................... Disabled
         PMF-PSK(802.11w)........................ Disabled
         OSEN-1X................................. Disabled
      FT Reassociation Timeout................... 20
      FT Over-The-DS mode........................ Disabled
      GTK Randomization.......................... Disabled
      SKC Cache Support.......................... Disabled
      CCKM TSF Tolerance......................... 1000

--More-- or (q)uit
   Wi-Fi Direct policy configured................ Disabled
   EAP-Passthrough............................... Disabled
   CKIP ......................................... Disabled
   Web Based Authentication...................... Disabled
   Web Authentication Timeout.................... 300
   Web-Passthrough............................... Disabled
   Mac-auth-server............................... 0.0.0.0
   Web-portal-server............................. 0.0.0.0
   Conditional Web Redirect...................... Disabled
   Splash-Page Web Redirect...................... Disabled
   Auto Anchor................................... Disabled
   FlexConnect Local Switching................... Disabled
   FlexConnect Central Association............... Disabled
   flexconnect Central Dhcp Flag................. Disabled
   flexconnect nat-pat Flag...................... Disabled
   flexconnect Dns Override Flag................. Disabled
   flexconnect PPPoE pass-through................ Disabled
   flexconnect local-switching IP-source-guar.... Disabled
   FlexConnect Vlan based Central Switching ..... Disabled
   FlexConnect Local Authentication.............. Disabled
   FlexConnect Learn IP Address.................. Enabled
   Client MFP.................................... Optional
   PMF........................................... Disabled

--More-- or (q)uit
   PMF Association Comeback Time................. 1
   PMF SA Query RetryTimeout..................... 200
   Tkip MIC Countermeasure Hold-down Timer....... 60
   Eap-params.................................... Disabled
AVC Visibilty.................................... Enabled
AVC Profile Name................................. UMP
Flow Monitor Name................................ UMP-NF_Monitor
Split Tunnel Configuration
    Split Tunnel................................. Disabled
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Disabled
802.11k Neighbor List Dual Band.................. Disabled
802.11v Directed Multicast Service............... Disabled
802.11v BSS Max Idle Service..................... Enabled
802.11v BSS Transition Service................... Disabled
802.11v BSS Transition Disassoc Imminent......... Disabled
802.11v BSS Transition Disassoc Timer............ 200
802.11v BSS Transition OpRoam Disassoc Timer..... 40

--More-- or (q)uit
DMS DB is empty
Band Select...................................... Enabled
Load Balancing................................... Client-Count Based
Multicast Buffer................................. Disabled
Universal Ap Admin............................... Disabled

 Mobility Anchor List
 WLAN ID     IP Address            Status                             Priority
 -------     ---------------       ------                             --------

802.11u........................................ Disabled

MSAP Services.................................. Disabled

Local Policy
----------------
Priority  Policy Name
--------  ---------------

Lync State ...................................... Disabled
Audio QoS Policy................................. Silver
Video QoS Policy................................. Silver
App-Share QoS Policy............................. Silver

--More-- or (q)uit
File Transfer QoS Policy......................... Silver

(Cisco Controller) >

[Leo Laohoo]

---

@mathemba wrote:

Interface........................................ umpwifi

---

Please post the complete output to the command "sh interface detail umpwifi".

[Leo Laohoo]

---

@mathemba wrote:

When we rebooted the AP's, they all came up with the new address but the SSID on our network disappeared.

---

So when the APs boot up, they were not broadcasting any SSID?  

Are the SSID enabled? 

Are the APs in the correct AP Group? 

Are the SSID broadcasting/hidden or not?

[mathemba]

Nothing has changed on the WLC, which means all AP groups and SSID's are still the same as before. I will try and ping an AP that has the new address from the WLC and see if the access lists are not blocking the new subnet.

[MUHAMMAD TAYYAB MUNIR]

Hi Mathemba,

Can you update the subnet mask under the Controller --> Interface --> SubnetMask. if after changing the subnet your SSID still not working kindly disable and enabled it  and share the ping results

BR,

Tayyab - www.tayyabmunir.com 

*** Please Rate***