WLAN configuration when WLC is behind a FW

[TrickTrick]

Hi,

In a scenario I'm working on, I have a WLC located behind a FW in a dedicated DMZ (let's say vlan 100), created a management interface to manage APs (interface in vlan 100, with FW ip as a GW in that vlan)

APs are located in the inside, in a different vlan, and are able to register with the WLC no issues.

now I want clients to get valid IPs from DHCP (VLAN 200 in the inside), but I can't create a WLAN interface in the same subnet as the VLAN in the inside part of the network (obviously when I do that the WLC becomes unreachable, and of course it's not recommended to extend the L2 network between the DMZ and the inside)

I think there's a way to create WLANS in the WLC with a subnet mapping between those wlans in the DMZ and the correspondent VLANS in the inside of the network, so the wireless clients can get IPs from the dedicated dhcp scope in the DHCP server (windows server) located in the inside as well

How can I achieve this please ? any document or information is highly appreciated 

Thank you

[Rich R]

So as already pointed out the WLC is layer 2 - think of it as a LAN switch.  You can't put a firewall between 2 switches on a VLAN (actually you can with layer 2 bump in the wire but I assume that's NOT what you're trying to do).  So trying to route your client layer 2 traffic through the firewall to the WLC is probably not a good idea at all (and why anyway - it serves no useful purpose).

So either you connect/trunk everything to WLC at layer 2 - local mode APs all centrally switched on WLC

OR

AP in flex mode with the WLANs local switching.  Then your traffic never even goes to the WLC - it's trunked direct from APs to the switchport they're connected to in the relevant VLAN.  Then DHCP and everything else works exactly the way it would for a LAN user.  This way no interface is needed on the WLC at all.

So decide what model you prefer and design accordingly.

[TrickTrick]

Hi,

Thank you for your input,

You pointed out exactly my problem, I was always wondering why a WLAN should be extended behind the FW if that's how a WLC works (I understood from FLavio in the comments that CAPWAP will tunnel that vlan traffic to its interface in he WLC), but the Flexconnect is here to solve that, I understand from you that  I don't need to create an interface dedicated to that WLAN and select the management interface for all the WLANs created instead, but, the AP are broadcasting different SSIDs (of different WLANs), how a client will get the right ip of its vlan in flexconnect mode ?

Thank you