Multicasting with a guest anchor configuration.

[mmacmahon]

Hi All

First time posting.

I have a guest anchor controller in our DMZ servicing Apple devices. We are looking at options for using Apple TV to display/stream presentations from executive iPads and such. Since it uses bonjour (multicast) would I be able to utilize the new features available in 7.0.116.0 to implement this solution? I have 4 WiSM 1s servicing the headquarters building and one 4402 guest anchor. I believe this is possible based on the note in the document: VLAN Select and Multicast Optimization Features Deployment Guide; specifically the section:

Note: In a Guest Tunneling scenario, roaming between export foreign and export foreign is supported. However, roaming between export foreign and export anchor is not supported with VLAN Select.

In case of Auto Anchor:

• Clients joining a foreign WLC, which is exported to an anchor WLC and mapped to a interface group, will receive an IP address in round robin method inside the interface group.

  
  

• Clients joining a foreign WLC, which is exported to an anchor WLC and mapped to a interface only, will receive an IP address from that interface only.

  
  

• Clients roaming between two or more foreign controllers mapped to a single anchor WLC with an interface group configured will be able to maintain its IP address.

  
  

Since I only have one guest anchor, I would assume based on this that I would fall under the export foreign - export foreign option and implementing this would be possible.

Could someone advise?

Thank you in advance!!

[Scott Fella]

I just had to do an install for one I my clients that wanted certain guest users to be able to use Apple TV and stream to iPads. We had an apple engineer who helped with this and here was the requirements. The Apple TV has to be wired and the iPads had to be on the same subnet as the Apple TV. No other way would work.... So basically we had to create a separate SSID and subnet for this network.

Sent from my iPhone

[George Stefanick]

As Scott mentioned you need to have your "i" devices and apple tv on the same subnet. But it sounds like your excutives are going to be using it, so why push it to the anchor not keep the traffic inside?

[George Stefanick]

I also recall somewhere (i could be wrong) that multicast didnt work in the EoIP tunnel. Like out to the DMZ. Scott do you recall that ?

[mmacmahon]

Thank you for replying Scott and George! I did some testing and I cannot pass multicast traffic through the EoIP tunnel; it is a feature request from Cisco for a future release. I created a local Vlan on my core for the controller's WLAN interface to attach to and used an AES-PSK for the devices. All traffic for that Vlan is sent through a firewall with the same ACLs as what is allowed in the DMZ, which gets pointed to the web filter. Same security basically and I can just disable the anchor relationship, no devices to touch. :-)

[alois.heilmaier]

Thank you for information, I have the same problem. So I made a search on EoIP tunnel and Multicast.

http://www.cisco.com/en/US/products/ps6366/products_qanda_item09186a00808b4c61.shtml

Q I have a guest tunneling, Ethernet over IP (EoIP) tunnel, configured between my 4400 Wireless LAN Controller (WLC), which acts as the anchor WLC, and several remote WLCs. Can this anchor WLC forward subnet broadcasts through the EoIP tunnel from the wired network to wireless clients associated with the remote controllers?

A. No, the WLC 4400 does not forward IP subnet broadcasts from the wired side to the wireless clients across the EoIP tunnel. This is not a supported feature. Cisco does not support tunneling of subnet broadcast or multicast in guest access topology. Since the guest WLAN forces the client point of presence to a very specific location in the network, mostly outside the firewall, tunneling of subnet broadcast can be a security problem.

unofortunately it seems that multicast over EoIP does not work.

[George Stefanick]

Yea, no love for Multicast inside a  EoIP tunnel ...

[vlad.mihailov]

George,

Do you know if the multicast messaging are forwarded to the anchor controller in the recent firmware or is it still an unsupported feature?

Thank you.