4x WAP4410N VLAN for guest network

[mynameismethoz]

Hi there everyone,

Looking to have an issue of mine resolved.  Currently I am running 4x WAP4410N access points configured with a single corporate ssid with WPA2 Enterprise authentication which is pointing to a network access protection server.  What I am trying to do is add a second ssid to all of my access points which is for guests only and cannot connect to corporate resources/devices.  I believe I have to VLAN in order for this to work properly.

The four access points are connected in various parts of the building and are wired into different SG300 switches.  One port on a SG300-52 in my server room is wired into a port on my firewall which I'd like to use for DHCP.

What will I need to do in order to get this functioning properly?  At the moment my test guest network isn't even giving out an IP address to devices, which I believe is related to the VLAN.

I'm not sure what ports I need to leave tagged/untagged, how to configure the vlan across the multiple switches, etc.  Any help would be appreciated.  It was suggested to me that I could use seperate access points entirely for guest access, but I'd like to keep the amount of access points down to the minimum required.

[mynameismethoz]

Anyone have a suggestion?

[mynameismethoz]

Getting no reply is disheartening, but I'll continue with my question...

I've managed to get this working on the switch which is directly connected to the firewall.  However, internet access is not working from the other switches which are wired into the primary switch.

What I've done is this:

Port 50 on the primary switch --- 2UP

Port 36 on the primary switch (which connects to the access point which is working) --- 1UP 2T

Port 41/42/44 on the primary switch (which connect to the other switches) --- 1UP 2T

On the secondary switches, the ports which lead to the primary switch --- 1UP 2T

On the secondary switches, the ports which connect to the access points --- 1UP 2T.

Any wireless connection on a guest network ssid which is hosted on a secondary switch is not reaching the firewall.  This leads me to believe there is an error in my configuration of the VLAN.  How do I need to set this up in order to have the secondary switches pass the VLAN information to the primary switch?  These are all SG300's.

[aunrein]

Hello,

Here are some things you might want to double check.

1) The guest VLAN should be configured on all devices in the network that handle that VLAN's traffic. (i.e. The firewall, switches, and access points)

2) On the firewall, make sure that DHCP is enabled for the guest VLAN.

3) On the access points, make sure that the guest SSID is only using the guest VLAN.

Check these settings. If they are not the problem, then we can try to figure something else out.

Thanks,

Alex

[mynameismethoz]

Thanks for the response.

The guest VLAN is present on all the devices.  VLAN 2 is set to tagged on all related ports and access points.  VLAN 2 is tied to the Guest SSID.  The Guest wireless works perfectly fine on the access point which is connected to the switch which contains the port running to the firewall, port 50. However, when I switch to an access point that is on a secondary switch I no longer reach the firewall on the guest ssid.  Corporate SSID still works perfectly fine on all switches.

This leads me to believe that there is an error in my configuration in relation to getting the VLAN information to travel between the switches.  The ports which connect to the primary switch on all secondary switches are trunk ports.

How is VLAN information supposed to travel inbetween switches?  As of now I have the VLAN information configured on the ports which connect the secondary switches to the primary switches and those access points are not working.

[Eric Moyers]

Hi, My name is Eric Moyers. I am a Network Support Engineer in the Cisco Small Business Support Center. Thank you for using the Cisco Community Post Forums.

I agree with your assessment on where the issue could be. So, what are the two switches in question here?  Could you give a little detail on that second switch?

Thanks

Eric Moyers    .:|:.:|:.

Cisco Small Business US STAC Advanced Support Engineer

CCNA, CCNA-Wireless

866-606-1866

Mon - Fri 09:00 - 18:00 (UTC - 05:00)

*Please rate the Post so other will know when an answer has been found.

[mynameismethoz]

Hi Eric, thanks for the reply.

The primary switch which is connected to the firewall is a SG300-52 Port Managed Switch.  It's in our server room and contains the port which is vlan'd to the firewall.  This switch has the access point which works properly as a guest network.

All of the secondary switches are SG300-20 Port Managed Switches.  There are two of them which have access points connected to them.  One has a single access point connected to it, the other has two access points connected to it.  All of these access point ports are configured as 1UP 2T because all of our access points also host the corporate ssid which is on 1.  The guest is on 2.

These SG300-20 switches have direct connections to ports 41,42,44 on the primary switch.  These are also tagged 1UP 2T.  The ports on these switches which run to the primary switch are taged 1UP 2T as well.

Basically every port involved in the process of getting back to the primary switch from the access point has been VLAN'd to include 2 and leaving 1 as untagged.  The only port which is 2UP is the firewall port on the primary switch.

[Eric Moyers]

Ok, are all of the AP, configured exactly the same? If you plug a PC (configured for VLAN2) into the port that the WAP is using can it get to the Internet? Does the Corporate SSID work correctly?

Eric

[mynameismethoz]

All APs are exactly the same aside from hostname, device name, and IP address.

Im unsure how I would be able to configure a PC for vlan 2.  I haven't tried it.  A PC directly to the firewall does get internet.

Corporate SSID works perfectly on all access points.

[mynameismethoz]

Eric, do you think that our switches all being on layer 3 would cause this problem?  They are all on layer 3.  I read an IBM article which stated:

"A trunk connection is a link that carries VLAN information between VLAN-aware Layer 2 devices."

http://publib.boulder.ibm.com/infocenter/tivihelp/v20r1/index.jsp?topic=%2Fcom.ibm.tivoli.tpm.net.doc%2Fnetwork%2Fcnet_trunking.html

[Eric Moyers · Accepted solution]

I do believe you may have found the problem. I apologize I did not ask if you were on Layer 2. I should have thought of that.

If they are all Layer 3, maybe you could just add some routes? Switching is not my strongest area.

Personally depending on your needs I would just do Layer 2 and use VLANs

Eric

[mynameismethoz]

I'll be doing the layer 2 switch. Unsure as to why they were on layer 3 in the first place --- before my time I suppose.

Thanks Eric and Alex for your suggestions.

[trgood]

Hi Mynameismethoz,

When you put the switch in L3 mode it still operates on L2 the same way.  L3 just gives you L3 capabilities on top of what you have with L2.  Unless you are using the switch as the default gateway or DHCP server I don't see why this would cause you any issues.

For me it sounds like you have everything setup correctly.  To troubleshoot I would set one interface on the problem switch to 2 untagged and connect a PC to it and see if you get an IP address and internet access.  If you don't have access move to the next switch in the data path to the firewall/dhcp server and set a port as 2Untagged again and see if you have access there.

Do this until you figure out where your VLAN 2 network connectivity drops off.  If you have VLAN 2 network connectivity on the switch where the AP in question is connected I would look at problems with the AP. 

A general rule of thumb when connecting devices is you want to ensure you have the same settings on each side.  Let me know if you have any questions.  Have a wonderful day!

-Trent Good

** Please rate useful posts! **

[mynameismethoz]

Just wanted to follow up.  Switching the mode to L2 from L3 across all switches made this work.  Apparently being in L3 caused the switches to be unable to communicate across the trunk the vlan tags.  All is now working properly.  Again, thanks!