VLAN & DHCP Issue

[Uberseehandel]

Hi

I am re-configuring my test network and an unexpected error has occurred. I am in the first stage of moving devices to appropriate VLANs. The VLANs used by the two SSIDs are circled in the screenshot below -

The phone attaches either of the SSIDs as selected -

However, the Access Point is reporting an error -

Doubtless, I've done something silly, but I am a little surprised at the mention of VLAN 0.

Any suggestions greatly welcomed.

[Uberseehandel]

@MilesMeraki

@Philip D'Ath

I've found a lot of information on the Cisco education site so I'll take it on board (hopefully weeding out the misleading stuff), and I'll re-organise the VLAN numbering scheme accordingly. I'm tempted by (room) 101 for the unused VLAN.

[zilla]

If you want the AP to be on VLAN 11 and the switch port to use VLAN 11 as it's native (or untagged) VLAN, here's what you should try.

Set the AP to DHCP and leave the VLAN tag blank.

Then set the switch port to native VLAN 11.

Then bounce the port.

If the AP's configured management VLAN matches the native VLAN on the switch port you will get this error.

The AP doesn't have a way of knowing what native VLAN the switch is configured for. In this case, it just knows that it's configured to use DHCP on a VLAN that it never gets traffic with the expected VLAN tag from the switch.

[Uberseehandel]

@zilla

Thanks for your suggestions.

I now have the VLANs configured pretty well the way I want them to work.

My next issues are to do with isolating "risky" devices into their own VLAN yet still be able to access their services, eg Bonjour or Chromecast.

Virtually all the "smart" devices I have seen are woeful from a security viewpoint, so should be kept away from the rest of the network, yet some are quite convenient. Whether it is at home or work, I cannot see us having fewer smart devices in the future. So we have to be able to find a way of being able to live with them, securely.

[Philip D'Ath]

Reading this again I missed this was an AP issue.

I would think by "VLAN0" it means the native or untagged VLAN.

The switch port that that the AP plugs into, I assume it is a trunk port. Is the native VLAN - VLAN1, or a different native VLAN?

[Uberseehandel]

---

@Philip D'Ath wrote:

Reading this again I missed this was an AP issue.

I would think by "VLAN0" it means the native or untagged VLAN.

The switch port that that the AP plugs into, I assume it is a trunk port. Is the native VLAN - VLAN1, or a different native VLAN?

---

At present he "default" VLAN is VLAN 1. At present all the switch ports are trunk ports.

My aim is to use VLAN 11 as the management VLAN and avoid using any defaults.

Its after 2235 here I'll get back to this in the morning (my time), thank you for your assistance.

Do I need to do anything on the switches other than set which VLANs each port will pass? Do I need to set up the ports to also pass the management VLAN when a client device is directly attached?

laters . .

[Philip D'Ath]

Since the AP is configured to use VLAN11, the port it plugs into on the switch should be a trunk port, and it can use a native VLAN of 1 (make sure the switch is not using a native vlan of 11). Make sure the switch port that connects to the MX is also a trunk port. Is this a Meraki switch?