Wireless LAN roaming question over Layer 3 LAN infrastructure - Page 2

gsidhu · ‎11-18-2013

Hi

My knowledge on WLAN is very limited so my question may sound very basic.

Layer 3 uplinks between collapsed core/distribution and access layer switches on each floor. Hence AP on each floor is on a different VLAN/subnet.

When a Client migrates between an AP, it retains the SSID and it also Retains its OLD DHCP address – it does not request a new one. Therefore, when client moves from one floor to another it keeps the IP from the previous floor.

Is it normal behavior that the client will maintain the same IP address when moving between floors (where the AP's are on different IP subnets) to maintian IP connectivity?

Jon Marshall · ‎11-18-2013

It'll work with the clients because wireless clients' traffic go through a LWAPP/CAPWAP tunnel and doesn't pop out until it reaches the WLC.

Now if you had just said that in the first place i would have stopped posting ages ago.

Thanks for the explanation. And i think i've had enough confusion for one day thanks

Jon

Leo Laohoo · ‎11-18-2013

Now if you had just said that in the first place i would have stopped posting ages ago.

Yes. So did I, come to think of it.

Jon Marshall · ‎11-18-2013

If you get the time can you have a look at this thread and see if there is a better way of doing things in terms of wireless. The question asks how to extend a vlan across multiple switches and i was so focussed on that it never occured to me there may be a better solution without having to redesign things. It's not clear whether he has a WLC or not and i suppose you need one for the tunnels but it may still be that you have a better solution than i gave.

https://supportforums.cisco.com/thread/2251546?tstart=60

Jon

Leo Laohoo · ‎11-18-2013

Jon,

PM sent regarding this thread.

Leo Laohoo · ‎11-18-2013

So what is the solution if you have L3 access to distro and you want your wireless clients to keep the same IP ie. span a vlan across floors.

You seem to be suggesting a redesign or using extra fibres is unnecessary, so how do you make it work properly ?

Sorry if i'm being a bit slow but it would help the OP and only last week i answered a question for a poster with the same problem ie he needed a WiFi vlan across multiple switches with routed links from access switches.

Ok, ok, ok ... There is another way.

Let say you have a multi-floor building and you have TWO SSID: CORP and Voice.

Notice that there is no "Guest" SSID. Let's say you created, say, FOUR dynamic interfaces: DI_CORP (stands for Dynamic Interface_CORP), DI_Guest, DI_VOICE and DI_Developers. Each Dynamic Interface has their own IP Subnet. We also create a GENERIC Dynamic Interface and our CORP SSID is plumbed that way. The GENERIC DI has some funky private IP address.

No brainer: VOICE SSID maps to DI_VOICE.

Let's say you want a single-sign-on. You want a developer to sign in to CORP and gets thrown into DI_Developers IP address, Guest login details gets DI_Guest IP address and regular users get thrown into DI_CORP IP address.

If this is what the OP wants, this can be done and uses 802.1x. We are not using Cisco ISE but using FreeRADIUS. Each site we have has about 10 Dynamic Interfaces but we only have a single SSID for CORP. So, like I've explained above, everyone goes into the Generic DI and based on your login details, the wireless clients gets "thrown into" the correct IP subnet.

Don't ask me the details about what they've done (to FreeRADIUS and 802.1x) because it's all French to me.

Jon Marshall · ‎11-18-2013

removed while i read last post

gsidhu · ‎11-18-2013

Hi Leo

Thank you for your advice.

There are a few other things that I found out about:

They have 2 x Cisco 5508 Wireless Controllers configured for redundancy and 3600 clean air Access Points over five floors in one building. In the future the APs will be rolled out over four more buildings.

The 5508 Wireless Controllers are located on a different site at the customers new Data Center. The wireless AP’s are configured for FlexConnect and local switching of traffic.

Questions

1) One option being considered is to create a single Layer 2 VLAN that spans all of the floors (eventually all of the floors across all six buildings. I have concerns about this approach as it does not fit in with Cisco best practise Campus design. Please could you let me have your thoughts

2) The 2 x 5508 Wireless Controllers are not on the Campus LAN. They are located at the customers new Data Center site which connects to the Campus of 10 Gbps WAN links. Is there any benefit in having the Wireless Controllers at a Data Center as opposed to connecting them on the Campus LAN?

Leo Laohoo · ‎11-18-2013

1)      One option being considered is to create a single Layer 2 VLAN that spans all of the floors (eventually all of the floors across all six buildings. I have concerns about this approach as it does not fit in with Cisco best practise Campus design. Please could you let me have your thoughts

One subnet per building and NOT per campus. Different buildings in a campus means multiple subnets.

2)     The 2 x 5508 Wireless Controllers are not on the Campus LAN. They are located at the customers new Data Center site which connects to the Campus of 10 Gbps WAN links. Is there any benefit in having the Wireless Controllers at a Data Center as opposed to connecting them on the Campus LAN?

Yes. Your WAN link. If your WAN link goes down (let's presume you don't have H-REAP/FlexConnect enabled), what do you think is going to happen?

Leo Laohoo · ‎11-18-2013

Forgot one thing: The size of your wireless client subnet.

Say you have 100 staff in each building, allocate three times the amount of available IP address. Why three? Studies have shown that each individual will have at least THREE wireless devices at any given time.