broadcast frames (gratuitous ARP) filtered by WLC ?

sagou.brahim · ‎08-10-2009

Hi all,

I am making some tests with a wireless architecture based on WLC4402. (I am rather new to wireless world...)

There is a gateway which sends gratuitous ARPs from the wired part of the network, and these broadcasts needs to reach wireless clients. (That gateway is of course put in the same vlan as the wireless clients).

These broadcast frames never reach wireless clients, while they reach wired clients put in the same vlan.

With some sniffing, I can see that the gratuitous ARPs are correctly sent from the LAN to the WLC, but it seems that they never come back to reach the wireless clients.

I enabled the option "Broadcast Forwarding" but without result.

The DHCP proxy feature is disabled.

I tried versions 4.2, 5.2 and 6.0.

So the ARP tables of the wireless clients are correctly updated only when I flush them or when I wait for the ARP entries to time out.

Do someone have any idea about what could filter the broadcasts? I am suspecting a security issue but I thought that the WLAN is supposed to be totally bridged with wired part of the LAN!!

Thanks in advance

Regards,

Brahim

zhenningx · ‎08-11-2009

WLC does suppress the broadcast frames. Please check this link:

http://www.cisco.com/en/US/docs/solutions/Enterprise/Mobility/emob41dg/ch2_Arch.html#wp1028269

To me, it is a nice feature. Some malwares may act as rouge DHCP server in the LAN and we don't need to worry about it in wireless LAN.

sagou.brahim · ‎08-12-2009

Hi,

Ok thanks for the link. I noticed two main points :

- The WLC forwards only IP Ethertype frames --> so ARP is not included ?

- WLC (by default) will not forward broadcasts or multicasts toward the wireless users.

Ok for these elements. But what happens during my tests is that the request ARP frames (which are broadcasted from the wired network) correctly reaches wireless clients (they are converted in unicast frames, with destination MAC address being wireless client address).

But gratuitous ARPs (which are also broadcasted from the wired network) seems to not receive the same treatment as they are not converted in unicast frames and do not reach the wireless user.

So I am wondering if the WLC is designed to forward only certain types of broadcasts, and if there is a documentation explaining clearly that behaviour.

Thanks very much,

Regards

brahim