Cisco 9800 VRF 17.13.x question

[msrohman]

Hi all,

Looking to design/deploy a couple IoT enterprise wireless networks.  One of the WLAN networks will have access to the Internet only. The second WLAN will have access to the Internet as well as the internal (trusted) network.   Could I leverage the VRF feature in 17.13.x to forward WLAN traffic an a network zone (DMZ1) for Internet only and create another WLAN with a VRF to a different network zone (DMZ2) that allows internal network access?

Thanks in advance.

[Flavio Miranda · Accepted solution]

@msrohman 

 Per cisco recommendation WLC should not have layer3 interface besides the management interface. Thus, if should not have VRF either.

 The proper design for what you want to accomplish, would be to work with 2 WLC and use the concept of Foreign/Anchor. One WLC on the DMZ and one on the Corp network.

[msrohman]

Got it. Thanks for the response. I'll look to design a solution similiar to the mentioned above.

[Flavio Miranda]

@msrohman  You can find tons of information about similar design if you look for wireless guest. It will be very similar to your requirement.

One WLC will hold the access point and it is called foreign and the traffic is send to another WLC in the DMZ which is call anchor.

 https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213912-configure-mobility-anchor-on-catalyst-98.html

[msrohman]

The challenge is that I have to put each group of IoT wireless devices into  DMZ zones and not  on the  internal network. But I'll take your appreciated advice and add a second anchor into a second DMZ zone that allows access to the internal network. I was trying to leverage one anchor for two different network zones within best design practices.

[Flavio Miranda]

@msrohman You may not need two WLC in DMZ. You can think of using two interfaces of the same WLC connected in different DMZ. You can map SSID1 to one DMZ and SSID2 to the second DMZ.

 I am considering that your IoT devices will be somewhere in your corp network and that´s why I am suggesting the setup foreign/anchor.

  This way, you can use the same Access point you use for Corp users to collect the data from IoT devices and pass the traffic up to the WLC on the DMZ.

 But, nothing can prevent you to join the Access point directly on the WLC in the DMZ and this way use only one WLC and not foreign/anchor schema.

[Scott Fella]

Just wanted to add some info.  I had a customer who wanted to tdo the same thing in multiple sites, but didn't want to purchase a controller in the DMZ.  What we ended up doing was dropping off the traffic in a vlan that had a VRF to the DMZ and that is how they separated traffic the way they wanted it.  They had a secure SSID that was all local to the site and for IoT and Guest, there was two separate VRF to different networks in the DMZ.

[Rich R]

I was going to say what @Scott Fella said already - simply use VLANs to separate the traffic then you can use VRFs at router layer - but don't use VRFs on the WLC.  Although they are technically supported now (for specific features only), they come with a whole bunch of caveats so are best avoided if at all possible.

Also note that you should never be using 17.13.x in a production network normally.  That is a limited support release which will never get any bug fixes or security updates.  Refer to the TAC Recommended link below and use an Extended Support release - 17.12.x, 17.15.x etc