Trouble with DHCP on wireless using EZVPN

tahequivoice · ‎08-20-2010

I have an 871W configured with 3 vlans, 2 are encrypted using EZVPN. Wired machines can get DHCP assigned, A hard phone, on the voice vlan, gets an IP, workstation on the work vlan gets an IP, wireless clients on the non encrypted bvi gets DHCP. I have an 1131 AP on the network and all wireless clients can get an IP. The only wireless clients that can get an IP from the 871 wireless is the non encrypted one. For some reason I have tied it down to the crypto ipsec client ezvpn VPN inside. When I remove it from the BVI interface, the 7921 phones can get an IP, but of course cant reach the server since the encryption is removed. I have 3 BVI interfaces, vlan 2,3 &4, and all three are setup with a wireless interface. All 3 are identical. the only exception is the EZVPN.

crypto ipsec client ezvpn EZVPN
connect auto
group Ezvpn-Split key keyname
mode network-extension
peer x.x.x.x
nat allow
username guessing password uwillneverknow

xauth userid mode local

Everything except getting an IP from vlan 2 and 3 on the wireless is working fine. I even hardcoded the IP on the phone and it still didnt work. I tried adding the crypto to the subinterface on the radio, but that didnt work either.

Atri Basu · ‎08-22-2010

Could you please attach your complete configuration?

tahequivoice · ‎08-22-2010

Im using EZVPN due that I dont have a static IP, and it changes frequently. I will try putting it on all 3 interfaces and see what happens.

Atri Basu · ‎08-24-2010

If the only reason your are using EZVPN is because you do not have a static ip address on one side then you can still configure a site-to-site vpn:

http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00801dddbb.shtml#conf

Regards,

Atri.

Jitendriya Athavale · ‎08-22-2010

never tried it out

but try putting bvi, radio subinterface and vlan in eazy vpn inside

also just had a work around, other the fact that it is eazy to deploy any particular reason you are using eazy vpn

i am thinking on lines of configuring site to site vpn for this router, this way we will not need to worry about configuring anything on the wireless interfaces other than ip nat inside

tahequivoice · ‎08-25-2010

We terminate all these on ASA 5500 series firewalls, none of them terminate on an IOS based router.

Since this is the first deployment using the 871 series with vlans to see if using our standards for Voip and Data will work for a remote office setup over Cable or DSL, I am doing it from my house. None of our other users, which we have over 100 of them on various firewalls, are having issues. The EZVPN deployments we use are working 100% for us, this is just a test bed, and other than the wireless portion, is working perfectly. If I cant get the wireless part to work, then we just wont deploy them using a wireles version router.

Main reason we went to using EZVPN to an ASA, they work perfectly behind the junk soho routers cable and DSL providers have, which makes our job easier, the customer unpacks the router and phone, follows the visio diagram we provide, and in minutes has their voice and data up and running. Before we did that, we would spend hours trying to get the router to connect to the internet so a GRE or DMVPN tunnel could be established. With the setup I have now, I can take my router and phone and go anywhere there is an nternet connection, plug it in and have my phone working and direct secure access to my company servers.

I will give the vlan a try and see if that works, if not, I will just shut the radio down on those vlans, and use the 1131 instead.

tahequivoice · ‎08-28-2010

Resolved. Always the simplest thing. The .2 radio interfaces was set for bridge group 1, although there is no bridge group 1 on the router, and usually IOS tells you so. Switched it to bridge group 2, and all is working now, at least network wise. Now I have a voice issue for the VOIP guys. roaming between the 871 to 1131 I dont drop the call, but the transition gets me one way audio, I lose the connection to the callmanagers when I switch AP's. Different group, so I dont expect any answers to that one. Thanks anyway to those who responded.