Wireless Options

ReidJones · ‎09-09-2014

I'm using a UC520 right now with 2 x AP521 access points. The building is 16,000 sq ft. I have 2 x Cisco 7925G cordless phones, however I have quite a few dropped calls and I think that could be caused by them handing off between networks. I would like to fix this, and also setup a guest WIFI network for the following.

It looks like my options are the following:

1) Buy a WLC526 used for about $150. My understanding is that this supports both Zero-Handoff and guest networks.

2) Buy 2 x Ubiquiti UAP-PRO for about $200 each.

What would you recommend, or would you recommend something else.

Thanks!

Dennis Bigelow · ‎09-16-2014

Hello,

From what it sounds like is you may just need more coverage. More is always better. There may be a spot that there is some kind of interferance.

There is free software that you can use to check your coverage.

If you are planning to replace your AP's I would also look at the Cisco WAP321. This has the guest network and also captive portal.

You can also set these up in a cluster of 8 for roaming and single point management.

You can find these online for less than $200.00 plus you also get 12 months of live support.

I hope this helps.

WAP321 Datasheet

http://www.cisco.com/c/en/us/products/collateral/wireless/wap321-wireless-n-selectable-band-access-point-single-point-setup/c78-697406_data_sheet.html

Regards,

Chris

ReidJones · ‎09-16-2014

Hi Chris,

Thanks for the info. By roaming, do you mean that my Cisco 7925G wireless phones could switch between AP's without interrupting a call?

If so, could you also confirm that no Wireless controller would be needed to handle this.

Thanks,

Reid

Dennis Bigelow · ‎09-16-2014

Hi Reid,

That is correct for both. The WAP321's are controllerless and you can add up to 8 per cluster. Once they are added to the cluster you just make the changes on one and the others will be updated.

The roaming allows you to move from AP to AP without losing connectivity so that the phones will not drop their call.

Regards,

Chris

ReidJones · ‎09-16-2014

Thanks Chris, I'll order up a few of the WAP371 to take advantage of dual-band and wireless AC/N.

EDIT: I noticed that there is also a WAP561. Is there much of an advantage to go to this model. There doesn't seem to be much of a price difference.

Dennis Bigelow · ‎09-16-2014

The WAP561 is more robust. You can cluster up to 16 WAP561's vs. 8 on the WAP321 and WAP371

The WAP561 has 3x3 multiple-input multiple-output (MIMO) with 3 spatial streams for 2.4 GHz and 5 GHz concurrent with 10 internal dipole antennas.

The WAP371 has 3x3 multiple-input multiple-output (MIMO) with 3 spatial streams at 5 GHz and 2x2 MIMO with 2 spatial streams at 2.4 GHz with 8 internal dipole antennas.

WAP561 requires PoE or power injector

WAP321/371 are PoE or power adapter

Regards,

Chris

ReidJones · ‎09-18-2014

Hi Chris,

I bought 2 of the WAP561 and have setup most of it just fine, with the exception of the unsecured guest network. I've created a new guest vlan 1000 on the UC520, and setup a guest network SSID on the WAP561 with the VLAN 1000, however when I try to connect with my phone, nothing happens. I can connect to the password protected data network just fine.

Any advise would be appreciated.

Thanks,

Reid

Dennis Bigelow · ‎09-19-2014

Hi Reid,

When you are trying to connect with a phone, do you mean a smart phone for internet access?

Regards,

Chris

ReidJones · ‎09-19-2014

Yeah, sorry, I meant iPhone. The only issue I see is that in the DHCP settings, for a VLAN with an IP of 192.168.25.1 (Guest VLAN), it won't let me put a router of 192.168.10.1 (data VLAN). Would this be causing the issue?

Dennis Bigelow · ‎09-19-2014

You will need to put the IP address for the Guest VLAN address of the UC for the router if the UC is routing out to the internet.

See if you can ping out to the internet from VLAN 1000 (Guest) on the UC.

This may be what's causing the issue.

Let me know.

Regards,

Chris

ReidJones · ‎09-19-2014

I went into Troubleshoot --> Ping, Set the interface to the guest VLAN and pinged google.ca with 100% success.

I should note, when I try to connect to the guest WIFI on my iPhone, the phone doesn't show as connected, but when I go to details on the network, it shows a IP address of 169.254.13.209 and a subnet mask of 255.255.0.0. In my DHCP settings it should be using a 192.168.25.X IP with a 255.255.255.0 subnet mask.

Dennis Bigelow · ‎09-25-2014

Hi Reid,

Have you tested access to to guest network with a laptop? Also did you set up the guest network with captive portal on the WAP561?

Is the DHCP disabled for all VLAN's on the WAP561?

You may need to call STAC to have them check the WAP and get this resolved for you in a timely manner. You have 12 months support and hardware on the 561.

The number is 1-866-606-1866.

Regards,

Chris

ReidJones · ‎09-24-2014

Hi Chris,

Still no luck here. My secure data vlan works fine over Wifi, but my guest Vlan and voice vlan are having issues. On the guest vlan, I can select the network, but the device issues its own IP address (169.254....). On the voice vlan, my Cisco 7925's reception bars light up yellow and I get the error "Connection failed".

My setup is as follows:

192.168.10.1 - Data Vlan (1)

192.168.25.1 - Guest Vlan (25)

10.1.1.1 - Voice Vlan (100)

Critical Information is Below:

ip dhcp relay information trust-all
ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 10.1.1.1 10.1.1.10
ip dhcp excluded-address 192.168.2.1 192.168.2.10
ip dhcp excluded-address 192.168.25.1 192.168.25.10
!
ip dhcp pool phone
 network 10.1.1.0 255.255.255.0
 default-router 10.1.1.1 
 option 150 ip 10.1.1.1 
!
ip dhcp pool data
 import all
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1 
!
ip dhcp pool Guest
 import all
 network 192.168.25.0 255.255.255.0
 default-router 192.168.25.1

interface Virtual-Template1 type tunnel
 ip unnumbered Vlan1
 ip nat inside
 ip virtual-reassembly in
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile SDM_Profile1
!
interface Vlan1
 description $FW_INSIDE$
 ip address 192.168.10.1 255.255.255.0
 ip access-group 102 in
 ip nat inside
 ip virtual-reassembly in
 ip tcp adjust-mss 1412
!
interface Vlan25
 description $FW_INSIDE$
 ip address 192.168.25.1 255.255.255.0
 ip access-group 104 in
 ip nat inside
 ip virtual-reassembly in
!
interface Vlan100
 description $FW_INSIDE$
 ip address 10.1.1.1 255.255.255.0
 ip access-group 103 in
 ip nat inside
 ip virtual-reassembly in
 ip tcp adjust-mss 1412

access-list 100 remark auto generated by SDM firewall configuration
access-list 100 remark SDM_ACL Category=1
access-list 100 deny   ip 192.168.10.0 0.0.0.255 any
access-list 100 deny   ip host 255.255.255.255 any
access-list 100 deny   ip 127.0.0.0 0.255.255.255 any
access-list 100 permit ip any any
access-list 101 remark auto generated by SDM firewall configuration##NO_ACES_8##
access-list 101 remark SDM_ACL Category=1
access-list 101 permit udp any host 10.1.10.2 eq non500-isakmp
access-list 101 permit udp any host 10.1.10.2 eq isakmp
access-list 101 permit esp any host 10.1.10.2
access-list 101 permit ahp any host 10.1.10.2
access-list 101 permit tcp 10.1.1.0 0.0.0.255 eq 2000 any
access-list 101 permit udp 10.1.1.0 0.0.0.255 eq 2000 any
access-list 101 deny   ip 192.168.25.0 0.0.0.255 any
access-list 101 deny   ip 192.168.10.0 0.0.0.255 any
access-list 101 deny   ip 10.1.1.0 0.0.0.255 any
access-list 101 deny   ip host 255.255.255.255 any
access-list 101 deny   ip 127.0.0.0 0.255.255.255 any
access-list 101 permit ip any any
access-list 102 remark auto generated by SDM firewall configuration##NO_ACES_6##
access-list 102 remark SDM_ACL Category=1
access-list 102 permit udp any host 192.168.10.1 eq non500-isakmp
access-list 102 permit udp any host 192.168.10.1 eq isakmp
access-list 102 permit esp any host 192.168.10.1
access-list 102 permit ahp any host 192.168.10.1
access-list 102 deny   ip 192.168.25.0 0.0.0.255 any
access-list 102 deny   ip 10.1.10.0 0.0.0.3 any
access-list 102 deny   ip 10.1.1.0 0.0.0.255 any
access-list 102 deny   ip host 255.255.255.255 any
access-list 102 deny   ip 127.0.0.0 0.255.255.255 any
access-list 102 permit ip any any
access-list 103 remark auto generated by SDM firewall configuration##NO_ACES_8##
access-list 103 remark SDM_ACL Category=1
access-list 103 permit udp any host 10.1.1.1 eq non500-isakmp
access-list 103 permit udp any host 10.1.1.1 eq isakmp
access-list 103 permit esp any host 10.1.1.1
access-list 103 permit ahp any host 10.1.1.1
access-list 103 permit tcp 10.1.10.0 0.0.0.3 any eq 2000
access-list 103 permit udp 10.1.10.0 0.0.0.3 any eq 2000
access-list 103 deny   ip 192.168.25.0 0.0.0.255 any
access-list 103 deny   ip 10.1.10.0 0.0.0.3 any
access-list 103 deny   ip 192.168.10.0 0.0.0.255 any
access-list 103 deny   ip host 255.255.255.255 any
access-list 103 deny   ip 127.0.0.0 0.255.255.255 any
access-list 103 permit ip any any
access-list 104 remark auto generated by SDM firewall configuration##NO_ACES_6##
access-list 104 remark SDM_ACL Category=1
access-list 104 permit udp any host 192.168.25.1 eq non500-isakmp
access-list 104 permit udp any host 192.168.25.1 eq isakmp
access-list 104 permit esp any host 192.168.25.1
access-list 104 permit ahp any host 192.168.25.1
access-list 104 deny   ip 10.1.10.0 0.0.0.3 any
access-list 104 deny   ip 192.168.10.0 0.0.0.255 any
access-list 104 deny   ip 10.1.1.0 0.0.0.255 any
access-list 104 deny   ip host 255.255.255.255 any
access-list 104 deny   ip 127.0.0.0 0.255.255.255 any
access-list 104 permit ip any any
access-list 105 remark SDM_ACL Category=2
access-list 105 deny   ip any host 192.168.10.110
access-list 105 deny   ip any host 192.168.10.111
access-list 105 deny   ip any host 192.168.10.112
access-list 105 deny   ip any host 192.168.10.113
access-list 105 deny   ip any host 192.168.10.114
access-list 105 deny   ip any host 192.168.10.115
access-list 105 deny   ip any host 192.168.10.116
access-list 105 deny   ip any host 192.168.10.117
access-list 105 deny   ip any host 192.168.10.118
access-list 105 deny   ip any host 192.168.10.119
access-list 105 deny   ip any host 192.168.10.120
access-list 105 permit ip 10.1.10.0 0.0.0.3 any
access-list 105 permit ip 192.168.10.0 0.0.0.255 any
access-list 105 permit ip 10.1.1.0 0.0.0.255 any
access-list 105 permit ip 192.168.25.0 0.0.0.255 any
access-list 106 remark auto generated by SDM firewall configuration##NO_ACES_20##
access-list 106 remark SDM_ACL Category=1
access-list 106 permit udp any any eq non500-isakmp
access-list 106 permit udp any any eq isakmp
access-list 106 permit esp any any
access-list 106 permit ahp any any
access-list 106 deny   ip 192.168.25.0 0.0.0.255 any
access-list 106 deny   ip 10.1.10.0 0.0.0.3 any
access-list 106 deny   ip 192.168.10.0 0.0.0.255 any
access-list 106 deny   ip 10.1.1.0 0.0.0.255 any
access-list 106 permit udp host 67.205.74.187 eq domain any
access-list 106 permit icmp any any echo-reply
access-list 106 permit icmp any any time-exceeded
access-list 106 permit icmp any any unreachable
access-list 106 permit udp host 192.168.10.1 eq 5060 any
access-list 106 permit udp host 192.168.10.1 any eq 5060
access-list 106 permit udp host 67.205.74.187 eq 5060 any
access-list 106 permit udp host 67.205.74.187 any eq 5060
access-list 106 permit udp any any range 16384 32767
access-list 106 deny   ip 10.0.0.0 0.255.255.255 any
access-list 106 deny   ip 172.16.0.0 0.15.255.255 any
access-list 106 deny   ip 192.168.0.0 0.0.255.255 any
access-list 106 deny   ip 127.0.0.0 0.255.255.255 any
access-list 106 deny   ip host 255.255.255.255 any
access-list 106 deny   ip host 0.0.0.0 any
access-list 106 deny   ip any any log
dialer-list 1 protocol ip permit

Extended IP access list 100
    10 deny ip 192.168.10.0 0.0.0.255 any
    20 deny ip host 255.255.255.255 any
    30 deny ip 127.0.0.0 0.255.255.255 any
    40 permit ip any any
Extended IP access list 101
    10 permit udp any host 10.1.10.2 eq non500-isakmp
    20 permit udp any host 10.1.10.2 eq isakmp
    30 permit esp any host 10.1.10.2
    40 permit ahp any host 10.1.10.2
    50 permit tcp 10.1.1.0 0.0.0.255 eq 2000 any
    60 permit udp 10.1.1.0 0.0.0.255 eq 2000 any
    70 deny ip 192.168.25.0 0.0.0.255 any
    80 deny ip 192.168.10.0 0.0.0.255 any
    90 deny ip 10.1.1.0 0.0.0.255 any
    100 deny ip host 255.255.255.255 any
    110 deny ip 127.0.0.0 0.255.255.255 any
    120 permit ip any any
Extended IP access list 102
    10 permit udp any host 192.168.10.1 eq non500-isakmp
    20 permit udp any host 192.168.10.1 eq isakmp
    30 permit esp any host 192.168.10.1
    40 permit ahp any host 192.168.10.1
    50 deny ip 192.168.25.0 0.0.0.255 any
    60 deny ip 10.1.10.0 0.0.0.3 any
    70 deny ip 10.1.1.0 0.0.0.255 any
    80 deny ip host 255.255.255.255 any
    90 deny ip 127.0.0.0 0.255.255.255 any
    100 permit ip any any (1779 matches)
Extended IP access list 103
    10 permit udp any host 10.1.1.1 eq non500-isakmp
    20 permit udp any host 10.1.1.1 eq isakmp
    30 permit esp any host 10.1.1.1
    40 permit ahp any host 10.1.1.1
    50 permit tcp 10.1.10.0 0.0.0.3 any eq 2000
    60 permit udp 10.1.10.0 0.0.0.3 any eq 2000
    70 deny ip 192.168.25.0 0.0.0.255 any
    80 deny ip 10.1.10.0 0.0.0.3 any
    90 deny ip 192.168.10.0 0.0.0.255 any
    100 deny ip host 255.255.255.255 any
    110 deny ip 127.0.0.0 0.255.255.255 any
    120 permit ip any any (32 matches)
Extended IP access list 104
    10 permit udp any host 192.168.25.1 eq non500-isakmp
    20 permit udp any host 192.168.25.1 eq isakmp
    30 permit esp any host 192.168.25.1
    40 permit ahp any host 192.168.25.1
    50 deny ip 10.1.10.0 0.0.0.3 any
    60 deny ip 192.168.10.0 0.0.0.255 any
    70 deny ip 10.1.1.0 0.0.0.255 any
    80 deny ip host 255.255.255.255 any
    90 deny ip 127.0.0.0 0.255.255.255 any
    100 permit ip any any
Extended IP access list 105
    10 deny ip any host 192.168.10.110
    20 deny ip any host 192.168.10.111
    30 deny ip any host 192.168.10.112
    40 deny ip any host 192.168.10.113
    50 deny ip any host 192.168.10.114
    60 deny ip any host 192.168.10.115
    70 deny ip any host 192.168.10.116
    80 deny ip any host 192.168.10.117
    90 deny ip any host 192.168.10.118
    100 deny ip any host 192.168.10.119
    110 deny ip any host 192.168.10.120
    120 permit ip 10.1.10.0 0.0.0.3 any
    130 permit ip 192.168.10.0 0.0.0.255 any (187 matches)
    140 permit ip 10.1.1.0 0.0.0.255 any
    150 permit ip 192.168.25.0 0.0.0.255 any
Extended IP access list 106
    10 permit udp any any eq non500-isakmp
    20 permit udp any any eq isakmp
    30 permit esp any any
    40 permit ahp any any
    50 deny ip 192.168.25.0 0.0.0.255 any
    60 deny ip 10.1.10.0 0.0.0.3 any
    70 deny ip 192.168.10.0 0.0.0.255 any
    80 deny ip 10.1.1.0 0.0.0.255 any
    90 permit udp host 67.205.74.187 eq domain any
    100 permit icmp any any echo-reply
    110 permit icmp any any time-exceeded
    120 permit icmp any any unreachable
    130 permit udp host 192.168.10.1 eq 5060 any
    140 permit udp host 192.168.10.1 any eq 5060
    150 permit udp host 67.205.74.187 eq 5060 any
    160 permit udp host 67.205.74.187 any eq 5060
    170 permit udp any any range 16384 32767 (12 matches)
    180 deny ip 10.0.0.0 0.255.255.255 any
    190 deny ip 172.16.0.0 0.15.255.255 any
    200 deny ip 192.168.0.0 0.0.255.255 any
    210 deny ip 127.0.0.0 0.255.255.255 any
    220 deny ip host 255.255.255.255 any
    230 deny ip host 0.0.0.0 any
    240 deny ip any any log (261 matches)

I'm hoping that you'll see something here that could be causing these issues.

Thanks!

Reid