WLC management with wifi Clients

[LUIGI PIETRONAVE]

Hi,

my topology is based upon 2 WLC 4402 in the same mobility group and RF group.

The strange behaviour that i'm having is that, after I enabled the management via wifi, i can only access the WLC connected to the AP I'm associated.

I tryied to move the my AP to the other WLC and in this situation, i can only access the other WLC.

Is that a normal behaviour ? It seems like the WLC does not accept management connection from the wifi network if they come from the ethernet port.

many thanks and regards

Luigi

[magress]

Hello Luigi,

This is a bug - CSCse97036.

Thanks,

Mark

[LUIGI PIETRONAVE]

Hi Mark,

thanks for Your reply but my problem is that, with a wifi client, i can access ONLY the wlc to which the AP i'm associated it's registered.

I cannot connet ( via GUI or telnet ) and ping the other WLC

Now i've think, if a client it's connected to and AP on WLC1 and another client is connected to an AP on WLC2, this clients will be able to comunicate each others? This mornig i'll try.

many thanks

Luigi

[zhenningx]

The clients should be able to communicate each others. The "Management Via Wireless" setting only blocks or allows the mgmt traffic from the wifi clients to the WLC.

[Benjamin Solero]

Hi,

It sounds like you are describing the correct behavior. From the config guide (see the part of the NOTE: "Wireless clients cannot manage another wireless controller with which they are not associated."):

**************************************

To enable Cisco Wireless LAN controller management from an associated wireless client, use the config network mgmt-via-wireless command.

-----------------------------------------

NOTE: This feature allows wireless clients to manage only the Cisco Wireless LAN controller associated with the client AND the associated Cisco 1000 series lightweight access point. That is, clients cannot manage another Cisco Wireless LAN controller with which they are not associated.

-------------------------------------------

http://www.cisco.com/en/US/products/ps6366/products_command_reference_chapter09186a00806ad2db.html#wp1324232

-Ben

[LUIGI PIETRONAVE]

Hi Ben,

thank You very much. Of course you are right.

I've seen also that I cannot ping the management interface from the L3 catalyst the controller is connected if the source interface of these ping is a VLAN different from the management VLAN.

This with the last SW; with the previous ( 4.0.155.5 ) all seems working fine.

I'll do other tests,

best regards

Luigi

[l.baumann]

Hi everybody

> I've seen also that I cannot ping the management

> interface from the L3 catalyst the controller is

> connected if the source interface of these ping

> is a VLAN different from the management VLAN.

We're experiencing the same thing with the following adaptation:

- We can't ping the controller's management interface from the L3 Switch if the source interface is different from the management VLAN AND it's one of the wireless VLANs.

- We can ping the controller's management interface from the L3 Switch if the source interface is different from the management VLAN AND if this VLAN is not used for wireless clients.

So, I guess this has to do with the note mentioned above ("Wireless clients cannot manage another wireless controller with which they are not associated.").

=> i.e. the controller can't distinguish whether the ping is from the L3 Switch, a wired PC in that VLAN, or from a wireless client. Consequently, the controller blocks all requests coming from a wireless VLAN but through the LAN interface...?!

Also, the bug-id mentioned above explains why this was working with 4.0.155.5.

Anyway, for me this restriction is a bit strange...

Regards

Lukas

[LUIGI PIETRONAVE]

Hi,

keeping in mind that "Wireless clients cannot manage another wireless controller with which they are not associated" this behaviour make sense.

It seems like the controller, when it see a packet from a wireless VLAN, it try to send it out from radio interface and.... if the client is there all works fine.

The controller has 2 connections on the same wireless VLAN: the wired interface and the radio interface. It seems like it was an arp related trouble: a strange issue, but at least now we know this.

Regards

Luigi