Wireless Bridging - Network Crashes if I connect more than one non-root bridge

[Dean Romanelli]

Hi All,

I have a site with six 2702 access points in a wireless bridging situation.  One of the AP's is the root bridge, and the other 5 are non-root bridges which are all configured identically aside from hostname and IP's. I want all 5 non-root bridge AP's to wireless bridge to the root bridge AP.  If I connect the root bridge to the network and power one of the non-root bridge AP's on, everything is fine.  However, if I power on multiple non-root bridge AP's beyond the first one, everything crashes. Why is that? 

Root and Non-Root Bridge AP configs attached below

[marce1000]

 - Please define in technical terms 'everything crashes'

M.

[Dean Romanelli]

Latency, packet loss on both wired and wireless networks to inside and outside destinations. 

It "feels" like a spanning-tree loop but I don't see how it could be. One thing I should mention is that I am powering the wireless bridges via POE off of a disconnected switch, as I'm waiting for power supplies to be delivered.  I had originally thought that was the issue, since bridged AP's shouldn't have the Ethernet port plugged in, but if that was the case, why does it work fine when only one bridge AP is plugged in? Again, the switch that powers them is not connected to the network. It is just there as a power source temporarily. 

[Mark Holm]

You could be creating a loop, if all the APs connect to the same switch. Each of the wireless links back to the root AP are redundant, so STP is needed to prevent a loop.

One quick way to test this is to configure the switchports connected to the ethernet port of the APs as trunks and then configure switchport trunk allowed vlan none - this way you still have PoE available, but no forwarding on any VLANs. If it prevents everything from crashing, you are likely having by a loop of some sort.

[Dean Romanelli]

Hi Mark,

Thanks, that is helpful actually.  The only thing that doesn't make sense to me though is that the switch I am using for POE is not connected to the network, so I'm not sure how it is affecting wired LAN performance on the network.  Wireless yes, can definitely see that, but not wired. 

[Mark Holm]

Hi Dean,

All of the APs connected to the "standalone" switch (lack of a better term) are still associated with a VLAN. Assuming you are just using a somewhat default configuration, all ports will be in the same VLAN. In theory, that means that on the wired side of the AP, any BUM traffic will be forwarded to the wired port of the other APs, which then forwards it over the wireless link back to the root AP. Then, the root AP forwards it back out on the radio to all non-root bridges (except the one it received it from). The traffic is then bridged back to the wired port connected to the standalone switch, and then it goes on and on. You have yourself a forwarding loop.

If you employ STP on the APs, you might risk blocking ports you do not want to block, depending on the root bridge placement. Hence my suggestion to stop all VLAN forwarding on the port. Another option is to put each of the APs wired port in its own VLAN. That way there's no logical connection between the APs wired ports, so you break the forwarding loop.

I can't recall if you are allowed to remove the bridge-group configuration on the GigE port. If you can, that would be an option too. Then the AP won't forward the traffic out the wired interface.

[Rasika Nayanajith]

Few suggestions,

1. Do not use WEP encryption, use WPA2/AES instead.

2. Use 5GHz (radio1) instead of 2.4GHz (radio 0)

Something like below may be guide you

hostname RB
!
dot11 ssid <BRIDGE>
authentication open
authentication key-management wpa version 2
wpa-psk ascii <PASSWORD>
infrastructure-ssid

!
interface Dot11Radio1
encryption mode ciphers aes-ccm
ssid <BRIDGE>
station-role root bridge
bridge-group 1
no shut
!
interface GigabitEthernet0
bridge-group 1
!
interface BVI1
ip address 192.168.152.105 255.255.255.0
ip default-gateway 192.168.152.221

********************

hostname NRB-1
!
dot11 ssid <BRIDGE>
authentication open
authentication key-management wpa version 2
wpa-psk ascii <PASSWORD>
infrastructure-ssid

!
interface Dot11Radio1
encryption mode ciphers aes-ccm
ssid <BRIDGE>
station-role non-root bridge
bridge-group 1
no shut
!
interface GigabitEthernet0
bridge-group 1
!
interface BVI1
ip address 192.168.152.101 255.255.255.0
ip default-gateway 192.168.152.221

HTH

Rasika

*** Pls rate all useful responses ***

[Dean Romanelli]

Hi Rasika,

Thanks, but these AP's are primarily used for handheld scanners in warehouse environments and those scanners are only WEP capable, so I don't have a choice.  As to the 5 gHz radio - These AP's are being used as omni-directional external wireless bridges between different physical buildings, so I need the biggest signal beacon I can get, which means 2.4 instead of 5. 

[Rasika Nayanajith]

Have a look into this post & see if you can use 2.4GHz just for client connectivity & backhaul using 5GHz.

In that case you have to use remote end AP as WGB. It may work well in your case

https://mrncciew.com/2014/01/04/wireless-wired-clients-behind-wgb/

HTH

Rasika

*** Pls rate all useful responses ***