Cat 9800 RLAN-Local Switching AP1815T

[most_ahdy]

I am trying to configure RLAN in 9800 with AP1815T without central switching or central DHCP.

The AP and the controller are in the same LAN, so I use the AP1815T as normal AP in local mode

I need a client connected using one of the three lan ports in the AP1815T, can reach the network through the AP WAN port. without tunneling it back to the controller through CAPWAP.

I created RLAN profile without any security.

I create RLAN policy profile with centeral switching and central DHCP disabled, and in the access policy I configure the VLAN ID (allowed in the switch trunk port connected to the AP1815T and also in the controller uplink), all other setting in RLAN policy are default.

This scenario did not work and I could not obtain IP address in the configured VLAN.

I just need to make sure that my scenario is possible. and if there is someone who implemented this scenario.

Thanks

[Scott Fella]

Did you follow the guide here: https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/215681-configure-oeap-and-rlan-on-catalyst-9800.html#anc11 <>

You also need to note that there is two ports that can be mapped,
https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-5/b_Cisco_Aironet_1815_Teleworker_Access_Point/b_Cisco_Aironet_1815_Teleworker_Access_Point_chapter_01010.html <>

[most_ahdy]

Hi Scott,

From the second link it mention  PSE-LAN1 and LAN2 can also be used as local interface if no RLAN is configured on them.

That mean that these interface can switch traffic in AP1815-T locally to the WAN port , not through the CAPWAP tunnel, is this correct?

The first link, I followed the same steps including the Policy tag which I did not mention in my first post.

Additionaly I disabled the central switching and central dhcp in RLAN policy to force the traffic to be switched locally inside the AP1815T as far as  I understand isnt?

[Scott Fella]

The port 1 is a pass-through on the same subnet as the ap, if that is what you want.  You also have to configure each ap and make sure the interfaces are check and pointing to the right vlan.  This is also what you defined in the Policy Tag, so check the ap under configuration > access point.  This works, because I have 1815w's and 1815t trunked in my lab working.

[most_ahdy]

Thanks Scott for your information ,

The setting of 1815T interface configuration did not appears until I upgrade the firmware of the 9800 controller from version  16.12 to 17.03.

And  when i connect a pc to lan1 it could obtain ip address in the same vlan of the Ap as your advice

But the column of VLAN ID of each port in 9800 AP configuration page is not editable, how can I change it  when the port in not in RLAN??  So i can assign the connected pc to diffrent vlan than that of the AP?

[Scott Fella]

Make sure you follow the guide because you need to create that vlan and also apply that to the policy tag. Then that is available in the drop down.

[Scott Fella]

Were you able to fix it?  You need to "Edit Policy Tag" and make sure you define the RLANs which id defined below the wlan policy.  (RLAN-POLICY Maps: 2)  The two (2) here is your mapping for port 2 & 3.  You also then need to apply this Policy Tag to the ap in order for the configuration to be enabled on the AP.  Once this is configured and applied to the ap, then you will see the interfaces in the configuration portion of the ap.

Attached are some images of my setup.

[most_ahdy]

Hi Scott,

  I reviewed the configuration, and I did find any deviation or missing configuration, I created a RLAN profile without any security, I created also RLAN policy profile with the needed vlan (created before in configuration-->vlan) and all other setting keeped default.

Under a policy tag (which I mapped later to the 1815T AP), Under RLAN policy map , I mapped the created RLAN profile to the RLAN policy profile for port 3 (as I need port 1 and 2 to be locally switched inside the 1815T AP, not to be switched through capwap tunnel).

I assign this policy tag to my 1815T AP, then apply, waiting some minutes, but when I open the Configuration --> AP and the interface tab

under VLAN ID it is still 0 and non editable.

from your screenshot you sent below I noticed that the AP in flex mode, do I need to convert the AP point to flex mode instead of local mode? please note that the AP and the controller are in the same subnet.

[Scott Fella]

Yes you need to use FlexConnect mode. The vlans for FlexConnect vs local are defined in different Policies.

[Scott Fella]

Keep in mind, that when an ap is in local mode, that basically say's that all traffic will come back to the controller.  Only in FlexConnect can you choose to have traffic come back to the controller or egress locally.  This is the same for any other access point.

[most_ahdy]

---

@Scott Fella wrote:

Keep in mind, that when an ap is in local mode, that basically say's that all traffic will come back to the controller.  Only in FlexConnect can you choose to have traffic come back to the controller or egress locally.  This is the same for any other access point.

---

As per my test and per your advice, when the ap is in local mode, and one of its ports is not assigned to RLAN, this port switch traffic locally in the AP using the AP VLAN, and doesnt use the capwap tunnel to the controller, as per my test I disconnect the controller from the network, and the PC connected to this not-RLAN port still can reach the network.

but my missed part here is to make this PC a member of another VLAN other than the AP vlan. should I use the flex mode instead?

[Scott Fella · Accepted solution]

There is always one port on these types of ap's that will always switch locally.  If you want to use RLAN, then you need to use FlexConnect... Now I say that, because that is what I did.  You need to be able to see the interface and vlan mappings on the AP in order to allow traffic from the other ports (rlan) to the switch.

[most_ahdy]

Ok I'll convert the mode to flex connect and test the results, thanks Scott for your info