07-22-2013 10:38 PM - edited 07-04-2021 12:29 AM
Hello,
I have installed a new Cisco-AP 2600 into my network. it is connected to a trunk port of my Cisco-Switch. on the Switch we have Multiple Vlans configured. My Access-Point has ip-address range from VLAN-1, the problem is that from within my AP i can not ping other VLANs andvise-virsa i can not ping my AP ip from other VLANs.
What can be the issue please advise
07-23-2013 03:39 AM
The AP needs to be connected to a trunk with the AP being in the native vlan. Have you specified the native vlan on the trunk?
If that isn't it, post your show run-config I from the AP and the port configuration on the switch.
Sent from Cisco Technical Support iPhone App
07-24-2013 12:36 AM
My AP is connected into switch Trunk-link and its native vlan is vlan-1 bydefault. my AP is also using VLAN-1 ip range. but still it is not working
here is my Switch and AP config>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Switch tunk port config-
interface FastEthernet0/13
description WIFI
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1,3,6
switchport mode trunk
no ip
AP config-
AP1#sho run
Building configuration...
Current configuration : 4266 bytes
!
! Last configuration change at 04:44:22 UTC Mon Mar 1 1993 by Cisco
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname AP1
!
!
logging rate-limit console 9
enable secret 5 $1$x2Fh$8ZhA/DZ3ETam1UrEnGDi10
!
no aaa new-model
ip cef
!
!
!
dot11 syslog
!
dot11 ssid FMFB 1st-Floor
vlan 1
authentication open
!
dot11 ssid FMFBGuest 1st-Floor
vlan 6
authentication open
mbssid guest-mode
!
dot11 ssid FMFBHO 1st-Floor
vlan 3
authentication open
mbssid guest-mode
!
!
crypto pki token default removal timeout 0
!
!
username Cisco password 7 00271A150754
!
!
bridge irb
!
!
!
interface Dot11Radio0
no ip address
!
encryption vlan 6 key 1 size 40bit 7 CE6B241F0B93 transmit-key
encryption vlan 6 mode wep mandatory
!
encryption vlan 1 key 1 size 40bit 7 472EA7B5111B transmit-key
encryption vlan 1 mode wep mandatory
!
encryption vlan 3 key 1 size 40bit 7 4B1C6B676A07 transmit-key
encryption vlan 3 mode wep mandatory
!
ssid FMFB 1st-Floor
!
ssid FMFBGuest 1st-Floor
!
ssid FMFBHO 1st-Floor
!
antenna gain 0
stbc
mbssid
speed basic-12.0 18.0 basic-24.0 36.0 48.0 54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8
. m9. m10. m11. m12. m13. m14. m15.
station-role root
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.3
encapsulation dot1Q 3
bridge-group 3
bridge-group 3 subscriber-loop-control
bridge-group 3 spanning-disabled
bridge-group 3 block-unknown-source
no bridge-group 3 source-learning
no bridge-group 3 unicast-flooding
!
interface Dot11Radio0.6
encapsulation dot1Q 6
bridge-group 6
bridge-group 6 subscriber-loop-control
bridge-group 6 spanning-disabled
bridge-group 6 block-unknown-source
no bridge-group 6 source-learning
no bridge-group 6 unicast-flooding
!
interface Dot11Radio1
no ip address
!
encryption vlan 1 key 1 size 40bit 7 F704A8800A33 transmit-key
encryption vlan 1 mode wep mandatory
!
encryption vlan 3 key 1 size 40bit 7 A228C53B4E14 transmit-key
encryption vlan 3 mode wep mandatory
!
encryption vlan 6 key 1 size 40bit 7 EF0679277D81 transmit-key
encryption vlan 6 mode wep mandatory
!
ssid FMFB 1st-Floor
!
ssid FMFBGuest 1st-Floor
!
ssid FMFBHO 1st-Floor
!
antenna gain 0
no dfs band block
stbc
mbssid
speed basic-12.0 18.0 basic-24.0 36.0 48.0 54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8
. m9. m10. m11. m12. m13. m14. m15.
power local -1
channel dfs
station-role root
!
interface Dot11Radio1.1
encapsulation dot1Q 1 native
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio1.3
encapsulation dot1Q 3
bridge-group 3
bridge-group 3 subscriber-loop-control
bridge-group 3 spanning-disabled
bridge-group 3 block-unknown-source
no bridge-group 3 source-learning
no bridge-group 3 unicast-flooding
!
interface Dot11Radio1.6
encapsulation dot1Q 6
bridge-group 6
bridge-group 6 subscriber-loop-control
bridge-group 6 spanning-disabled
bridge-group 6 block-unknown-source
no bridge-group 6 source-learning
no bridge-group 6 unicast-flooding
!
interface GigabitEthernet0
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0.1
encapsulation dot1Q 1 native
bridge-group 1
bridge-group 1 spanning-disabled
no bridge-group 1 source-learning
!
interface GigabitEthernet0.3
encapsulation dot1Q 3
bridge-group 3
bridge-group 3 spanning-disabled
no bridge-group 3 source-learning
!
interface GigabitEthernet0.6
encapsulation dot1Q 6
bridge-group 6
bridge-group 6 spanning-disabled
no bridge-group 6 source-learning
!
interface BVI1
ip address 192.168.2.241 255.255.255.0
!
ip default-gateway 192.168.2.250
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
!
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
login local
transport input all
!
end
AP1#
07-24-2013 03:43 AM
If you connect a laptop with an IP address in that vlan 1 range and connect it to that same port, can you ping the gateway?
Sent from Cisco Technical Support iPhone App
07-24-2013 01:39 PM
I have a similar issue. In my case, I am not using native vlan for SSID. I can connect my laptop to other SSIDs, get the correct ip address from DHCP server, defined on the switch. Problem is, I loose AP management connectivity.
The switch and AP management IP are in same subnet. the management vlan is allowed on the trunk link. but no remote connectivity to ap!
What could be wrong?
Regards,
Girish
07-25-2013 01:51 AM
Yes i can even ping the Gateway from the AP itself aswell. but the problem is that i can not ping any other vlans. intervlan routings are working fine, and clients which connect through this ap can communicate with any vlans. only from the AP itself i can not ping other vlans and from other vlans i can not ping the AP maangement ip-address
07-25-2013 03:35 AM
That is usually an issue with the default gateway. Is this default gateway correct
ip default-gateway 192.168.2.250
Sent from Cisco Technical Support iPhone App
07-26-2013 08:58 PM
There is not an issue with Default-Gateway, and that is a correct GW address.
07-27-2013 05:12 AM
Post "show run int vlan1 " & "show ip route" output of the switch you have defined vlan 1 SVI. Also what is the switch model & IOS version ?
07-26-2013 09:35 PM
My Access-Point has ip-address range from VLAN-1, the problem is that from within my AP i can not ping other VLANs andvise-virsa i can not ping my AP ip from other VLANs.
You've got routing issues.
If your BVI1 is in VLAN 1, then can anyone ping the default gateway of VLAN 1?
07-27-2013 10:32 PM
Dear Rasikanayanajith,
It is my switch model-
C3550-I9Q3L2-M), Version 12.1(19)EA1c
and here is my show command outputs-
VTP#sho ip route
Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is 10.1.1.1 to network 0.0.0.0
10.0.0.0/24 is subnetted, 1 subnets
C 10.1.1.0 is directly connected, Vlan8
192.168.102.0/27 is subnetted, 1 subnets
C 192.168.102.0 is directly connected, Vlan5
C 192.168.2.0/24 is directly connected, Vlan1
C 192.168.100.0/24 is directly connected, Vlan3
192.168.101.0/28 is subnetted, 1 subnets
C 192.168.101.192 is directly connected, Vlan4
S* 0.0.0.0/0 [1/0] via 10.1.1.1
------
VTP#sho ip int vlan 1
Vlan1 is up, line protocol is up
Internet address is 192.168.2.250/24
Broadcast address is 255.255.255.255
Address determined by non-volatile memory
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP fast switching on the same interface is disabled
IP Flow switching is disabled
IP CEF switching is enabled
IP CEF Fast switching turbo vector
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is disabled
WCCP Redirect outbound is disabled
WCCP Redirect inbound is disabled
WCCP Redirect exclude is disabled
BGP Policy Mapping is disabled
VTP#VTP#sho ip int vlan 1
Vlan1 is up, line protocol is up
Internet address is 192.168.2.250/24
Broadcast address is 255.255.255.255
Address determined by non-volatile memory
MTU is 1500 bytes
Helper address is not set
Directed broadcast forwarding is disabled
Outgoing access list is not set
Inbound access list is not set
Proxy ARP is enabled
Local Proxy ARP is disabled
Security level is default
Split horizon is enabled
ICMP redirects are always sent
ICMP unreachables are always sent
ICMP mask replies are never sent
IP fast switching is enabled
IP fast switching on the same interface is disabled
IP Flow switching is disabled
IP CEF switching is enabled
IP CEF Fast switching turbo vector
IP multicast fast switching is disabled
IP multicast distributed fast switching is disabled
IP route-cache flags are Fast, CEF
Router Discovery is disabled
IP output packet accounting is disabled
IP access violation accounting is disabled
TCP/IP header compression is disabled
RTP/IP header compression is disabled
Probe proxy name replies are disabled
Policy routing is disabled
Network address translation is disabled
WCCP Redirect outbound is disabled
WCCP Redirect inbound is disabled
WCCP Redirect exclude is disabled
BGP Policy Mapping is disabled
VTP#
07-27-2013 10:37 PM
Dear Leo,
No one can ping Default-GW of vlan-1.
If i connect my wireless pc to this ap and give it ip-address range from other VLANs (vlan2,3..) then i can ping its related vlan GW address, and traffic normaly passes. but if i give my wirelss pc ip-add from VLAN-1 then i can not ping anything, No access at all, even i can not ping VLAN-1 GW and can not ping AP Management ip.
07-28-2013 06:03 AM
So your saying from another switch, you can't pings the vlan 1 interface also?
Sent from Cisco Technical Support iPhone App
07-29-2013 07:14 AM
It is recommended best practice that vlan 1 be shut down. I tried below configuration and it worked.
I can put my laptop in vlan 10 subnet and can access the switch and the AP for management purposes. But when I connect to the 3 SSIDs, I cannot ping the AP management IP address. Though I can reach the switch.
I believe, this as some kind of AP management restriction via wireless vlans in the new aIOS.
Same is true if you replace vlan 10 with vlan 1.
on the switch (3560G-48TS),
Vlan10
name Management
!
Vlan100
name RED_SSID
!
Vlan101
name GREEN_SSID
!
Vlan102
name YELLOW_SSID
!
interface Vlan10
ip address 10.10.10.1 255.255.255.0
!
interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
switchport trunk native vlan 10
switchport trunk allowed vlan 10,100-102
switchport mode trunk
switchport nonegotiate
!
on the AP ( i used 3502I and also 1042I Auto AP)
interface Dot11Radio0.10
encapsulation dot1Q 10 native
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface GigabitEthernet0.10
encapsulation dot1Q 10 native
bridge-group 1
bridge-group 1 spanning-disabled
no bridge-group 1 source-learning
!
interface BVI1
ip address 10.10.10.3 255.255.255.0
!
ip default-gateway 10.10.10.1
!
bridge irb
bridge 1 route ip
!
Just my few cents.
HTH.
07-28-2013 04:03 AM
Your configuration is fine. I have tested it with 3750 switch & 1142 AP & everything work as expected (I can ping from .241 IP to any vlan on my 3750). If you have any other layer 3 switch I would suggest you to test this AP with that. Or else try with upgrading IOS to a later version.
If you really want to see what's going on at packet level, you could do a packet capture while pinging from your AP to any other vlan.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: