Hi Nicolas
what could be the problem, if the WGB does not advertise via IAPP?
Here are the configurations of the Root-AP, the WGB and the Switch (where the WGB is connected) -> I shortened the configuration (there are a lot more VLANs and SSIDs, but it is still long for a net pro post).
For me there are the following points on the WGB, which are not clear why they are configured (the configuration made another company):
1. the aaa groups are not needed on the WGB?
2. in my opinion, the dot11Radio 0.900 should not be the configured as native VLAN?
Maybe you just see any other problems.
Root-AP
*********
aaa new-model
!
!
aaa group server radius rad_eap
server x.x.x.x auth-port 1645 acct-port 1646
!
aaa group server radius rad_mac
server x.x.x.x auth-port 1645 acct-port 1646
!
aaa group server radius rad_acct
server x.x.x.x auth-port 1645 acct-port 1646
!
aaa group server radius rad_admin
!
aaa group server tacacs+ tac_admin
!
aaa group server radius rad_pmip
!
aaa group server radius dummy
!
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods group rad_mac
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
aaa session-id common
dot11 vlan-name Data_WPA_PSK vlan 900
!
dot11 ssid VLAN900
vlan 900
authentication open
authentication key-management wpa
wpa-psk ascii 7 xxx
!
dot11 wpa handshake timeout 500
dot11 ids mfp detector
dot11 network-map
power inline negotiation prestandard source
!
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
encryption vlan 900 mode ciphers tkip
!
ssid VLAN900
!
speed basic-1.0 basic-2.0 5.5 11.0
no power client local
power client 14
power local cck 14
power local ofdm 14
no preamble-short
channel 2437
station-role root
rts threshold 2312
!
interface Dot11Radio0.900
encapsulation dot1Q 900
no ip route-cache
bridge-group 50
bridge-group 50 subscriber-loop-control
bridge-group 50 block-unknown-source
no bridge-group 50 source-learning
no bridge-group 50 unicast-flooding
bridge-group 50 spanning-disabled
!
interface FastEthernet0
no ip address
no ip route-cache
speed 100
full-duplex
!
interface FastEthernet0.900
encapsulation dot1Q 900
no ip route-cache
bridge-group 50
no bridge-group 50 source-learning
bridge-group 50 spanning-disabled
!
interface BVI1
ip address x.x.x.x x.x.x.x
no ip route-cache
!
ip default-gateway x.x.x.x
ip http server
ip http access-class 2
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
access-list 2 remark Telnet_Zugriff
access-list 2 permit x.x.x.x x.x.x.x
radius-server attribute 32 include-in-access-req format %h
radius-server dead-criteria tries 2
radius-server host x.x.x.x auth-port 1645 acct-port 1646 key 7 xxx
radius-server retransmit 2
radius-server deadtime 1
radius-server vsa send accounting
!
control-plane
!
bridge 1 route ip
!
sntp server x.x.x.x
WGB
******
aaa new-model
!
!
aaa group server radius rad_eap
server x.x.x.x auth-port 1645 acct-port 1646
!
aaa group server radius rad_mac
server x.x.x.x auth-port 1645 acct-port 1646
!
aaa group server radius rad_acct
server x.x.x.x auth-port 1645 acct-port 1646
!
aaa group server radius rad_admin
!
aaa group server tacacs+ tac_admin
!
aaa group server radius rad_pmip
!
aaa group server radius dummy
!
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods group rad_mac
aaa authorization exec default local
aaa accounting network acct_methods start-stop group rad_acct
!
ip dhcp pool xxx
!
!
dot11 vlan-name Data_WPA_PSK vlan 900
!
dot11 ssid VLAN900
vlan 900
authentication open
authentication key-management wpa
wpa-psk ascii 7 xxx
!
dot11 ids mfp detector
dot11 network-map
power inline negotiation prestandard source
!
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
encryption vlan 900 mode ciphers tkip
!
ssid VLAN900
!
speed basic-1.0 basic-2.0 5.5 basic-11.0 6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0
power local 2
power client 14
no preamble-short
station-role workgroup-bridge
!
interface Dot11Radio0.900
encapsulation dot1Q 900 native
no ip route-cache
bridge-group 1
!
interface FastEthernet0
no ip address
no ip route-cache
speed 100
full-duplex
bridge-group 1
!
interface BVI1
ip address x.x.x.x
no ip route-cache
!
ip default-gateway x.x.x.x
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
access-list 2 permit any
radius-server attribute 32 include-in-access-req format %h
radius-server host x.x.x.x auth-port 1645 acct-port 1646 key 7 xxx
radius-server vsa send accounting
bridge 1 route ip
bridge 1 address yyyy.yyyy.yyyy forward FastEthernet0
bridge 1 address yyyy.yyyy.yyyy forward FastEthernet0
bridge 1 address yyyy.yyyy.yyyy forward FastEthernet0
!
sntp server x.x.x.x
Switch
********
aaa new-model
aaa group server tacacs+ tacacsgroup
server x.x.x.x
!
aaa authentication login default group tacacsgroup local-case
aaa authorization exec default group tacacsgroup local
aaa accounting exec default start-stop group tacacsgroup
aaa accounting commands 15 default start-stop group tacacsgroup
!
aaa session-id common
clock timezone MET 1
clock summer-time UTC recurring last Sun Mar 2:00 last Sun Oct 3:00
system mtu routing 1500
vtp domain mah
vtp mode transparent
ip subnet-zero
!
no file verify auto
!
spanning-tree mode rapid-pvst
spanning-tree portfast bpduguard default
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
vlan 900,xxx-xxx
!
interface FastEthernet0/1
switchport access vlan 900
switchport mode access
speed 100
duplex full
no cdp enable
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/2
switchport access vlan 900
switchport mode access
speed 100
duplex full
no cdp enable
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/3
switchport access vlan 900
switchport mode access
speed 100
duplex full
no cdp enable
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/4
switchport trunk encapsulation dot1q
switchport trunk native vlan 900
switchport trunk allowed vlan 900
switchport mode trunk
speed 100
duplex full
no mdix auto
spanning-tree portfast trunk
!
interface FastEthernet0/5
switchport access vlan 900
switchport mode access
speed 100
duplex full
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/6
switchport access vlan 900
switchport mode access
speed 100
duplex full
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/7
switchport access vlan 900
switchport mode access
speed 100
duplex full
spanning-tree portfast
spanning-tree bpduguard enable
!
interface FastEthernet0/8
switchport access vlan 900
switchport mode access
speed 100
duplex full
spanning-tree portfast
spanning-tree bpduguard enable
!
interface GigabitEthernet0/1
!
interface Vlan1
no ip address
no ip route-cache
!
interface Vlan900
ip address x.x.x.x x.x.x.x
no ip route-cache
!
ip default-gateway x.x.x.x
ip classless
no ip http server
!
tacacs-server host x.x.x.x
tacacs-server directed-request
tacacs-server key 7 xxx
radius-server source-ports 1645-1646
!
control-plane
!
rtr 10
type echo protocol ipIcmpEcho x.x.x.x
request-data-size 128
owner Jnet
tag xxx
distributions-of-statistics-kept 5
statistics-distribution-interval 50
lives-of-history-kept 2
buckets-of-history-kept 5
filter-for-history all
rtr schedule 10 life forever start-time now
rtr 20
type echo protocol ipIcmpEcho x.x.x.x
request-data-size 128
owner Jnet
tag xxx
distributions-of-statistics-kept 5
statistics-distribution-interval 50
lives-of-history-kept 2
buckets-of-history-kept 5
filter-for-history all
rtr schedule 20 life forever start-time now
!
ntp clock-period 36029004
ntp server x.x.x.x prefer
Thanks a lot and regards
Dominic
