JJonas Posted October 9, 2014 Posted October 9, 2014 (edited) We have a Ruckus ZoneDirector 3050 and a Smoothwall SWG-1200 on site and we are trying to set up BYOD. One of our Windows servers is set up with DHCP to service our computers with IP Addresses (in the range 10.*.*.*) Smoothwall have reconfigured our SWG-1200 with a private IP(172.*.*.*) on one of our Smoothwall interfaces Ruckus has a guest network set up and configured. When BYOD users connect to this guest network they are being given an IP address from our DHCP server which is not in the private range. We need them to be given an IP address on the private IP range. How do I resolve this? Is it possible to configure Ruckus so that people connecting to the guest network get handed an IP address from the private range? Edited October 9, 2014 by JJonas
zag Posted October 9, 2014 Posted October 9, 2014 I was going to say, we have BYOD setup so that the Aruba controller works as a DHCP server. I assume Ruckas can work this way as well. All the firewall and vlan stuff is internal to our Aruba controller and the clients simply use the transparent proxy on the smoothwall. Its worked well so far as they are on a completely different subnet and IP range and we can configure the ports open as well.
JJonas Posted October 9, 2014 Author Posted October 9, 2014 There is an option within Ruckus to configure DHCP but I believe this is for all wireless networks rather that just one. Plus we already have a DHCP server so if we add another one we will get conflicts.
mikkydoos Posted October 9, 2014 Posted October 9, 2014 Smoothwall have reconfigured our SWG-1200 with a private IP(172.*.*.*) on one of our Smoothwall interfaces Ruckus has a guest network set up and configured. I'm after an answer for this too. For your guest network..... Your LAN uses your DC DHCP and your guest WLAN uses Smoothwalls DHCP ?? Y ?
JJonas Posted October 9, 2014 Author Posted October 9, 2014 We only have the DC DHCP apparently our version of Smoothwall doesn't come with a DHCP server.
IrritableTech Posted October 9, 2014 Posted October 9, 2014 Are your byod devices in a different vlan from your domain machines?
plexer Posted October 9, 2014 Posted October 9, 2014 Smoothwall are going to be releasing a BYOD addon that works with the SWG and UTM series I think @tom_newton ??? Ben 1
JJonas Posted October 9, 2014 Author Posted October 9, 2014 No, there are no Vlans configured at the moment, but the guest wireless LAN itself is configured with Access Control lists to effectively only allow them access to the Internet (Smoothwall box) so therefore we have not used Vlans. The access points cover a large site and are connected to multiple switches so we are not really sure what would be involved with configuring Vlnas. If it is essential to do this then we will investigate how to do this but it seems if we could just sort this DHCP issue out then we would not need it.
mdrabble Posted October 9, 2014 Posted October 9, 2014 Can you not run the guest network in isolation mode? They connect, get an IP on your network but cannot browse to other devices on your network unless you put an exception in place. - at least that is how I understand it
IrritableTech Posted October 9, 2014 Posted October 9, 2014 (edited) A DHCP client request is a broadcast - it has no known destination. Your ACL may not have any effect. If you vlan, you can then setup an ip-helper address for the different vlans. This forwards the broadcast to the correct server. Edited October 9, 2014 by IrritableTech 1
JJonas Posted October 9, 2014 Author Posted October 9, 2014 If you vlan, you can then setup an ip-helper address for the different vlans. This forwards the broadcast to the correct server. Thanks, next question how do I do that? Do you know of a good guide?
JJonas Posted October 14, 2014 Author Posted October 14, 2014 We have created a VLAN called BYOD on our HP5412ZL Switch. We have tagged the ports that the Ruckus points connect to on the switch. We have made a BYOD WLAN with the usual guest control/isolation We have associated the VLAN id on the Ruckus WLAN to match that of the VLAN on the switch. What we need to work out now is how we make clients connecting to the Ruckus BYOD WLAN have IP address details that match the interface we have configured on our Smoothwall box(172.*.*.* We think we might need to use ip helper and the Cli on the HP switch to somehow relay it an alternate DHCP scope configured on our DC DHCP Server. Does this sound right? Can anyone give us any help/guidance/advice on how to do this because this is very new to us.
IrritableTech Posted October 14, 2014 Posted October 14, 2014 (edited) Yeah this is easier than it seems sometimes. You need something like this in your switch config... vlan 10 name "BYOD" tagged A1-A6,Trk1-Trk4 ip address 172.16.10.254 255.255.255.0 ip helper-address 10.0.1.1 exit Then you create a DHCP scope on your windows DHCP server (10.0.1.1)... Scope: 172.16.10.1 - 172.16.10.253 Router: 172.16.10.254 DNS: 10.0.1.1, 10.0.1.2 Because the DHCP server gets the request via the router it allocates an IP address from the same range. Edited October 14, 2014 by IrritableTech Adjusted to use your example IPs 1
JJonas Posted October 14, 2014 Author Posted October 14, 2014 So if we make an additional scope on our DHCP server for the range 172.*.*.* when we switch a machine on in one of our labs what prevents them be assigned an IP address from this scope rather than the regular one(10.*.*.*)? 1
Davit2005 Posted October 14, 2014 Posted October 14, 2014 The DHCP server will know what network the device is on and give it an appropriate IP address. Below is a post regarding setting up vLANS on Cisco Switches but there is a section a third down the page which explains how it works. *How to* Multiple VLAN’s, Single DHCP Server, Multiple DHCP Scopes | Michaelriccioni.com 1
IrritableTech Posted October 14, 2014 Posted October 14, 2014 (edited) It's down to where the request originates from. If the request for a DHCP lease comes from your router 10.*.*.* address, that's the scope where the DHCP server will assign it from. If the request comes via the routers 172.*.*.* address, then DHCP will reply with a 172.*.*.* address. As long as you have all ports correctly assigned, and the vlans and two scopes set up correctly, it'll just work. The example below assumes your DHCP server is in the same VLAN as you curriculum machines. You could create another servers vlan and pop your DHCP server in that vlan. If you do, you'll need to add an ip helper-address into the curriculum vlan, so they can get DHCP leases as well. For example... vlan 5 name "Curric Network" untagged B1-D24 ip address 10.0.5.254 255.255.255.0 exit vlan 10 name "BYOD" tagged A1-A6 ip address 172.16.10.254 255.255.255.0 ip helper-address 10.0.5.1 exit I remember the first time I did this, it surprised me how simple it was. Edited October 14, 2014 by IrritableTech 1
JJonas Posted October 15, 2014 Author Posted October 15, 2014 if I telnet into my HP 5412 and do show ip helper-address I get VLAN: 1 IP Helper Address ------------------------ VLAN: 2 IP Helper Address ------------------------ What command do I have to enter to populate these?
Davit2005 Posted October 15, 2014 Posted October 15, 2014 (edited) Log into the switch Type Show vlans to list the vlan ID's if need be Type config t click enter Type vlan [vlan id] e.g. vlan 100 to go into the vlan you want to configure the helper address on. Type ip helper-address [ip address of the DHCP server on the different subnet] i.e. ip helper-address 192.168.1.1 exit out Type wr m to Save the config Edited October 15, 2014 by Davit2005
JJonas Posted October 15, 2014 Author Posted October 15, 2014 Can we just clarify that we can have an additional private range scope on our actual domain DHCP server(10.103.20.11)? So for example, our domain scope is 10.103.20.1 - 10.103.23.255 and the new one we have made called BYOD is in the range 172.16.1.3 - 172.16.1.254 We have a Smoothwall virtual interface setup with an IP address of 172.16.1.1 What IP address do we need to define on VLAN 2 itself? Can you please look at the attached screenshot and tell us where we are going wrong
IrritableTech Posted October 15, 2014 Posted October 15, 2014 Are you running the smoothwall as a proxy?
Davit2005 Posted October 15, 2014 Posted October 15, 2014 Are you using the HP switch to do the Layer 3 routing?? We have our main core switch doing the routing, each vlan is configured with an IP address that will be that vLANS gateway, the DHCP has this as a gateway in the options for the vLAN DHCP zone With this setup the layer 3 switch forwards traffic to the ISP router
JJonas Posted October 15, 2014 Author Posted October 15, 2014 @IrritableTech Yes, we are running the Smoothwall as a proxy. All school traffic goes through Smoothwall interface 10.103.20.5. Smoothwall remotely configured another interface with IP address 172.16.1.1, designed for BYOD. They also set-up the bridging to allow it to communicate with our DNS server but couldn't do DHCP. @Davit2005 The core switch is literally as it was when it came out of the box. We gave it an IP address, connected all the fibres, enabled STP and have not touched it since. As you can see, we are novices when it comes to VLANS :-) So, should we configure the BYOD VLAN with the next available IP address in the range which would be 172.16.1.2 and set the Gateway to be the same in the Scope Option for Gateway on the DHCP server. Thanks guys for your help - it's much appreciated.
JJonas Posted October 15, 2014 Author Posted October 15, 2014 Every time I change the Gateway on the BYOD VLAN interface, it ALSO changes the Gateway on the Default VLAN! Firstly, I thought I had done it in error but I have tried it 3 times now - it's major brown trousers time when you loose connectivity!
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now