Help with configuring an integrated WLC / 3750

Answered Question
Jun 2nd, 2010

Hi all,

I am currently working on a demo box which Cisco sent me of an integrated 3750 / WLC.

I am testing out as a solution for remote sites which need wireless guest access on non-cisco APs (aruba Xirrus etc).

Here's what i have so far,

WLC/3750 is configured as a remote WLC with an anchor tunnel (carrying guest traffic) back to the anchor WLC in our data center, which then drops the traffic into the guest authentication DMZ.

The anchor tunel is functioning properly, but my question is specifically related to the integrated device. How do i configure the switch to allow one of it's ports to take this guest traffic (vlan 10 for conversation's sake) and then drop it directly onto the anchor tunel of the WLC?

Any information specific to working with the integrated appliance would be very helpful, as documentation on this is scarce.

Thanks in advance

I have this problem too.
0 votes
Correct Answer by weterry about 6 years 6 months ago

So... Here is what should be done:

Vlan 10 should be created on the switch as a Layer 2 vlan only. Do not make a SVI (interface vlan 10) on the switch.

Now, as long as the SWITCHPORTS going to the WLC (typically Po40 and gi1/0/27-28) are allowing vlan 10 through the trunk, and you have an interface vlan 10 for the guest access, then everything should work great.

For any client device that gets in to vlan 10 (any switchport that is access vlan 10, or any device that will egress traffic to vlan 10), the client should do its typical broadcast behavior to arp for DHCP/gateway/etc....   these broadcasts will make it in to the WLC, the WLC will get them to the ANCHOR and your client should get DHCP from the anchor.  Once this has been established, all of your clients unicast traffic should be switched into the WLC on vlan 10 and then sent to the anchor.  Does that make sense?

Bottom line:  Make sure vlan 10 has no layer 3 point. As long as vlan 10 is completely seperated from the other networks and it that it trunks into the WLC, then any client traffic that is in vlan 10 should go into the WLC and then the WLC will take that traffic and get it where it needs to go.

Does this help any?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
weterry Fri, 06/04/2010 - 07:41

Just so I understand correctly, you are trying to use the controller inside the 3750 basically for Wired Guest Access, right?

The Wireless LAN Controller in that hardware is basically the same thing as if you had a 4402 with a 2-port LAG/Etherchannel going to the Switch.

So I'm pretty sure that the Wired Guest Access documents should help you out:

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00808ed026.shtml

Bottom line is that you need to make a Guest LAN Interface for VLAN 10.

Then you make a Wired Guest LAN (like a WLAN), and you say its ingress interface is the vlan 10 interface.

You'll anchor that interface to the DMZ WLC like you would a WLAN.

On the DMZ WLC you'll create a similar Wired Guest LAN, but you'll put the "egress" interface to be what ever interface on that WLC drops in the DMZ....

Perhaps I'm mis understanding what you are trying to accomplish?

scottread1 Fri, 06/04/2010 - 07:49

Thanks for your post weterry.

The connection between the local WLC and the DMZ WLC has been established, and the guest traffic is set up to transfer properly.

The only thing that i'm not sure of is how ,on the switch, to configure a port(s) for wired guest in this scenario. If i just assign those ports to vlan 10 will it automatically send that traffic into the WLC, which will recognize it as guest?

This wouldn't be too much of an issue if i had a seperate switch / WLC, just not sure how to manage the internal connection between the WLC and Switch.

Thanks in advance

Correct Answer
weterry Fri, 06/04/2010 - 07:57

So... Here is what should be done:

Vlan 10 should be created on the switch as a Layer 2 vlan only. Do not make a SVI (interface vlan 10) on the switch.

Now, as long as the SWITCHPORTS going to the WLC (typically Po40 and gi1/0/27-28) are allowing vlan 10 through the trunk, and you have an interface vlan 10 for the guest access, then everything should work great.

For any client device that gets in to vlan 10 (any switchport that is access vlan 10, or any device that will egress traffic to vlan 10), the client should do its typical broadcast behavior to arp for DHCP/gateway/etc....   these broadcasts will make it in to the WLC, the WLC will get them to the ANCHOR and your client should get DHCP from the anchor.  Once this has been established, all of your clients unicast traffic should be switched into the WLC on vlan 10 and then sent to the anchor.  Does that make sense?

Bottom line:  Make sure vlan 10 has no layer 3 point. As long as vlan 10 is completely seperated from the other networks and it that it trunks into the WLC, then any client traffic that is in vlan 10 should go into the WLC and then the WLC will take that traffic and get it where it needs to go.

Does this help any?

scottread1 Mon, 06/07/2010 - 05:17

Thanks Weterry,

I'll give that a try and see how it goes.

Thanks for you help

Actions

This Discussion

Related Content

 

 

Trending Topics: Other Wireless Mobility

client could not be authenticated
Network Analysis Module (NAM) Products
Cisco 6500 nam
reason 440 driver failure
Cisco password cracker
Cisco Wireless mode