1131 config issue, not connecting.

[alzzstar84]

im at a loss, i have setup a 1131 with multiple ssid's, they show up, but neither one will connect. i need 2 ssid's, one open and one protected. this is the config i have so far:

!
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname ap
!
enable secret 5 $1$lrBX$8Z39Oh0JQPGmxWdHEvXo20
!
ip subnet-zero
ip domain name s02710.US.wal-mart.com
ip name-server 10.223.80.132
!
!
no aaa new-model
!
dot11 ssid Ncc Guest
   vlan 30
   max-associations 50
   mbssid guest-mode
!
dot11 ssid Ncc Staff
   vlan 20
   max-associations 50
   mbssid guest-mode
!
dot11 network-map
power inline negotiation prestandard source
!
!
username Cisco password 7 14341B180F0B
!
bridge irb
!
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 ssid Ncc Guest
 !
 ssid Ncc Staff
 !
 mbssid
 speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
 station-role root
 bridge-group 1
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface Dot11Radio0.20
 encapsulation dot1Q 20
 no ip route-cache
 bridge-group 20
 bridge-group 20 subscriber-loop-control
 bridge-group 20 block-unknown-source
 no bridge-group 20 source-learning
 no bridge-group 20 unicast-flooding
 bridge-group 20 spanning-disabled
!
interface Dot11Radio0.30
 encapsulation dot1Q 30
 no ip route-cache
 bridge-group 30
 bridge-group 30 subscriber-loop-control
 bridge-group 30 block-unknown-source
 no bridge-group 30 source-learning
 no bridge-group 30 unicast-flooding
 bridge-group 30 spanning-disabled
!
interface Dot11Radio1
 no ip address
 no ip route-cache
 shutdown
 !
 ssid Ncc Guest
 !
 ssid Ncc Staff
 !
 mbssid
 speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
 station-role root
 bridge-group 1
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface Dot11Radio1.20
 encapsulation dot1Q 20
 no ip route-cache
 bridge-group 20
 bridge-group 20 subscriber-loop-control
 bridge-group 20 block-unknown-source
 no bridge-group 20 source-learning
 no bridge-group 20 unicast-flooding
 bridge-group 20 spanning-disabled
!
interface Dot11Radio1.30
 encapsulation dot1Q 30
 no ip route-cache
 bridge-group 30
 bridge-group 30 subscriber-loop-control
 bridge-group 30 block-unknown-source
 no bridge-group 30 source-learning
 no bridge-group 30 unicast-flooding
 bridge-group 30 spanning-disabled
!
interface FastEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
 bridge-group 1
 no bridge-group 1 source-learning
 bridge-group 1 spanning-disabled
 hold-queue 160 in
!
interface FastEthernet0.20
 encapsulation dot1Q 20
 no ip route-cache
 bridge-group 20
 no bridge-group 20 source-learning
 bridge-group 20 spanning-disabled
!
interface FastEthernet0.30
 encapsulation dot1Q 30
 no ip route-cache
 bridge-group 30
 no bridge-group 30 source-learning
 bridge-group 30 spanning-disabled
!
interface BVI1
 ip address 192.168.1.175 255.255.255.0
 no ip route-cache
!
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
!
!
control-plane
!
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
 login local
!
end

 
 But, its not working.... what have I done wrong?
 

[Stephen Rodriguez · Accepted solution]

under both of the dot11 ssid, you need to add the following command

authentication open

and you should probably add a PSK to the Staff SSID as well.

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

[alzzstar84]

adding psk, best to do through command or gui?

[Stephen Rodriguez · Accepted solution]

depends on your comfort level.  I prefer the CLI, but GUI works as well.

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

[alzzstar84]

hmm, get to connect now, but no ip from dhcp.  i figure the ap would just echo, am i incorrect ?

[Stephen Rodriguez]

the switchport is a dot1q trunk, that allows VLAN 1, 20 and 30?

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

[alzzstar84]

thats the issue. these will be running of a simple linksys router. how do i change that? i dont have any catalysts pushing these. just dhcp server on linksys router with 192.168.x.x range.

im very new at these as you can tell, thanks so much for your help stephen!

[Stephen Rodriguez]

no worries. 

If you don't have a configurable switch, then this won't work.  You will need to remove the VLAN from the SSID, and the interfaces.  The downside is you will either be open, or have a PSK, since we can't use the vlan to differentiate the encryption.

HTH,
Steve

------------------------------------------------------------------------------------------------
Please remember to rate useful posts, and mark questions as answered

[alzzstar84]

duh... i just realized that... ive been battling this all day today not realizing I cant use vlans... grrr... ok, no big loss, got enough ap's to cover. alright, let me try setting up a basic one and see if I can succeed in that... lol