I am not able to ping Radius Servers from WLC (Mobility Express)

[pozoteleco]

Hi everybody;

I have the following question, i just installed and configured WLC controller with 7 AP's, the management interface have the ip address 192.168.10.90. i am able to ping the interface vlan 10 (internally is the management vlan) of switch 1 (192.168.10.22) and even i am able to ping from WLC whatever ip address from managament vlan of all of devices of my network. I tried to ping my radius server 10.102.100.1 too, but in this case i am not be able to.

On switch 1 i can ping the radius ip address 10.102.100.1 , and also i tried ping 10.102.100.1 source 192.168.10.22 and i can ping.

What could it be the problem??

[Rasika Nayanajith]

On the ME AP, do you have default-gateway setting point it to your SW IP (10.22) ?

HTH

Rasika

[pozoteleco]

Sure,

(Cisco Controller) >show interface detailed management

Interface Name................................... management
MAC Address...................................... 00:00:5e:00:01:01
IP Address....................................... 192.168.10.90
IP Netmask....................................... 255.255.255.0
IP Gateway....................................... 192.168.10.22
IP Address Type.................................. Static
External NAT IP State............................ Disabled
External NAT IP Address.......................... 0.0.0.0
Link Local IPv6 Address.......................... fe80::c6f7:d5ff:feb3:1a60/64
STATE ........................................... NONE
Primary IPv6 Address............................. ::/128
STATE ........................................... NONE
Primary IPv6 Gateway............................. ::
Primary IPv6 Gateway Mac Address................. 00:00:00:00:00:00
STATE ........................................... CREATING
VLAN............................................. untagged
Quarantine-vlan.................................. 0
Physical Port.................................... 1
DHCP Proxy Mode.................................. Global
Primary DHCP Server.............................. Unconfigured
Secondary DHCP Server............................ Unconfigured


Is there something wrong? Kind regards.

[Rasika Nayanajith]

That's look normal.

What happen if you put a PC on vlan 10 & see if you can ping RADIUS server from that PC ? 
To double check, pls share your switchport configuration that connects to ME

Rasika

[pozoteleco]

If i connect a Laptop Directly to the switch in vlan 10, i am able to ping to whatever side.

The switchport configuration is the same like i put in the scheme.

I think the problem it should be here:

(Cisco Controller) >show system route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 0.0.0.0 0.0.0.0 U 0 0 0 srcr3
7.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 srcr3
192.0.2.0 0.0.0.0 255.255.255.0 U 0 0 0 virtual


What is your opinion??

What it should be the command to configure routes??

Kind regards.

[pozoteleco]

I still having the problem, could you help me? :(

[patoberli]

Can you run a packet capture on the Radius server to see if your Ping packets actually arrive? That would help to somewhat isolate the problem.
What release of ME are you running on the APs?
Do you have an ACL configured on the ME?

[pozoteleco]

Hi!
1 - I didn't see any ping arriving to the radius server.

2 - For AP the version is:
cisco AIR-AP1815I-E-K9 ARMv7 Processor rev 5 (v7l) with 1015824/658320K bytes of memory.
Processor board ID FGL2325B2F5
AP Running Image : 8.8.125.0
Primary Boot Image : 8.8.125.0
Backup Boot Image : 8.5.140.0
Primary Boot Image Hash:
Backup Boot Image Hash:
AP Image type : MOBILITY EXPRESS IMAGE
AP Configuration : MOBILITY EXPRESS CAPABLE

3 - No ACL created yet.

Kind regards.

[patoberli]

For testing, remove the Native VLAN on the Switchport, or do not tag it on the AP.
It's either native (and not tagged) or tagged and not native.

[pozoteleco]

So you mean to remove switchport trunk native vlan 10 from switch and tag the management interface of controller with vlan 10 ??

Kind regards.

[patoberli]

It depends on your setup, but essentially yes try this for testing.

[Mirza]

Hi pozoteleco,

I am having the same issue, so how do you fix it?

Thanks