Solved: WLC Configuration with multiple vlans and ssids

shah.a.jawad · ‎03-14-2016

Hi Everyone,

I have a scenario in which WLC 2504 is connected to Core switch 4507R+E.and access switches are connected to Core switch as well. In these access switches Access points AIR-CAP702I-A-K9.

My question is as follows:

I want to use vlan 104 for office employes with SSID OFFICE-EMPLOYES

I want to use vlan 103 for guest with SSID Office-Guests

Below is what i have configured on core switch

(config)#interface xx

(config)#description xxx

(config)#switchport mode trunk

(config)#switchport trunk allowed vlan 103,104

Below is what i have configured on access switches

(config)#interface xx

(config)#swithcport mode access

(config)#swithcport access vlan 104

If i am configuring trunk port on access switches and allowing both vlan's 103 & 104 access points are not joining controller.

Right now management IP is from vlan 104 and all access points and clients are getting ip from 104 vlan.

What shall i do in this scenario.I want to use segregate the guest and office employe traffic.

It would be great if any one can help me.

Sandeep Choudhary · ‎03-14-2016

Hi,

I am assuming that AP management vlan is 104 !!!!!

Please check these:

Core switch config for WLC:

interface GigabitEthernet XX
description *** Cisco WLC ***
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 103,104
switchport mode trunk
no shutdown
!

Access Switch for Lightweight AP:

interface GigabitEthernet1/0/22
description *** AP ***
switchport access vlan 104
switchport mode access
no shutdown

Uplink port from core switch to access switch and vice versa must be configured as trunk port.

Regards

Don't forget to rate helpful posts

View solution in original post

Sandeep Choudhary · ‎03-15-2016

1. Configure the WLC port as trunk and allow the vlans which you need.(103, 104)

2. AP must be configured on access port (vlan 104).

3. Create one dynamic interface in WLC for vlan 103.(name as vlan103)

*** Management interface is already there ...is in vlan 104.

4. Create two ssid on WLC(Office-Employee and Office-Guest)

5. Assign management interface to Office-Employee and vlan103 to Office-Guest)

Regards

Don't forget to rate helpful posts

View solution in original post

Sandeep Choudhary · ‎03-14-2016

Hi,

I am assuming that AP management vlan is 104 !!!!!

Please check these:

Core switch config for WLC:

interface GigabitEthernet XX
description *** Cisco WLC ***
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 103,104
switchport mode trunk
no shutdown
!

Access Switch for Lightweight AP:

interface GigabitEthernet1/0/22
description *** AP ***
switchport access vlan 104
switchport mode access
no shutdown

Uplink port from core switch to access switch and vice versa must be configured as trunk port.

Regards

Don't forget to rate helpful posts

shah.a.jawad · ‎03-15-2016

Hi Sandeep,

Really appreciate your quick response,

Yes you are right . We have a vlan for wireless-employee named as 104, and vlan 103 is office-guest.

Management ip to the WLC is from VLAN 104(10.10.105.240/23)

as i said earlier guest users will get ip from vlan 103 and they should join ssid office guests.

if i allow only vlan 104 on the access switch interface,clients will get only ip range from 104 vlan which they are already getting.

I have configured two ssid's

1) office-employe

2)office-guest

both ssid's should get different ip arrange.as in my case we are getting two ssid displayed but clients are getting ip address only from vlan 104, as it is allowed on switches interface connected to access point.

what shall i configure to allow multiple vlan to the access points.

Sandeep Choudhary · ‎03-15-2016

1. Configure the WLC port as trunk and allow the vlans which you need.(103, 104)

2. AP must be configured on access port (vlan 104).

3. Create one dynamic interface in WLC for vlan 103.(name as vlan103)

*** Management interface is already there ...is in vlan 104.

4. Create two ssid on WLC(Office-Employee and Office-Guest)

5. Assign management interface to Office-Employee and vlan103 to Office-Guest)

Regards

Don't forget to rate helpful posts

mohanak · ‎03-14-2016

Configure the Layer 2 Switch Port that Connects to the WLC as Trunk Port

You need to configure the switch port to support the multiple VLANs configured on the WLC because the WLC is connected to a Layer 2 switch. You must configure the switch port as an 802.1Q trunk port.

Each controller port connection is an 802.1Q trunk and should be configured as this on the neighbor switch. On Cisco switches, the native VLAN of an 802.1Q trunk, for example VLAN 1, is left untagged. Therefore, if you configure a controller's interface to use the native VLAN on a neighbor Cisco switch, make sure you configure the interface on the controller as untagged.

A zero value for the VLAN identifier (on the Controller > Interfaces window) means that the interface is untagged. In the example in this document, the AP-Manager and Management Interfaces are configured in the default untagged VLAN.

When a controller interface is set to a non-zero value, it should not be tagged to the native VLAN of the switch and the VLAN must be allowed on the switch. In this example, VLAN 60 is configured as the native VLAN on the switch port that connects to the controller.

This is the configuration for the switch port that connects to the WLC:

interface f0/12
Description Connected to the WLC
switchport trunk encapsulation dot1q
switchport trunk native vlan 60
switchport trunk allowed vlan 103,104
switchport mode trunk
no ip address

This is the configuration for the switch port that connects to the router as a trunk port:

interface f0/10
Description Connected to the Router
switchport trunk encapsulation dot1q
switchport trunk native vlan 60
switchport trunk allowed vlan 103,104
switchport mode trunk
no ip address

This is the configuration for the switch port that connects to the LAP. This port is configured as an access port:

Refer link : http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-vlan/70937-guest-internal-wlan.html#C3

http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-vlan/68100-wlan-controllers-vlans.html

interface f0/9
Description Connected to the LAP
Switchport access vlan 104
switchport mode access
no ip address

niima · ‎01-16-2018

Hi Mates,

I do have the same issue, how did you manage to resolve this?

1) My WLC is not directly connected to Core Switch, Core is in a different floor, where via fiber optic connected to another Layer3 switch, and this port is a trunk, carrying VLAN 10, 20 and 30.

2) WLC is connected then via its port 1 to the access switch off in VLAN10 as an access port.

3) VLAN 10 is my management segment, with 10.10.10.x ip and all APs are in this segment.

4) I would like to have 3 SSIDs, for the above 3 VLAN mentioned, VLAN10 for office managers(APs can remain in this segment as this is a secure zone), VLAN 20 for office staffs (10.10.20.x) and VLAN 30 for guests (10.10.30.x)

5) VLAN10 remains in "management" dynamic interface. port 1 as active port and 0 as backup is assigned by default.

6) I created dynamic interface for VLAN20 with respective IP addresses. (DHCP Server is 10.10.10.4), assigned port 2 and port 0 as backup.

7) I created dynamic interface for VLAN30 with respective IP addresses. (DHCP Server is 10.10.10.4), assigned port 3 and port 0 as backup.

6) I have created 3 SSIDs, VIPs, Staffs and Guests.

7) in WLAN settings of VIPs I let the interface to be tied to management.

8) in WLAN settings of Staffs I set the interface to be tied to VLAN20 dynamic interface.

9) in WLAN settings of Guests I set the interface to be tied to VLAN30 dynamic interface.

However, only those who connect to SSID VIPs can get and IP address. It couldn't be due tp the fact that my DHCP server is in 10.10.10.x segment, as I have already enabled ip routing on my core and inter-vlan routing is 100% working.

Kindly please guide me in this

Scott Fella · ‎01-16-2018

Niima,

You should open a new thread on this. It gets difficult when the thread gets too long and this also helps keep things in order.

-Scott
*** Please rate helpful posts ***