BYOD - DHCP issue

[JJonas]

No problem, lets keep trying... You and @JJonas both from the same establishment right? :-)

 

Yes, we are

 

Ping 172.16.1.3 (switch) does it work? Ping 172.16.1.1 (smoothwall) does it work? Ping 10.103.20.11 (server) does this work?

 

I assume we are doing this from the laptop?

[JJonas]

 

Ping 172.16.1.3 (switch) does it work? Ping 172.16.1.1 (smoothwall) does it work? Ping 10.103.20.11 (server) does this work?

 

If this doesn't work... where exactly did things break?

 

I can ping the switch but not the Smoothwall or server.

[IrritableTech]

I can ping the switch but not the Smoothwall or server.

 

Ok - that sounds to me like the smoothwall either doesn't have the right IP setup on its (v)NIC, or it's not tagged in the right VLAN - probably the latter 'cos I just realised my suggested config didn't account for the SW!

 

[edit] Where does the smoothwall plug in? Did you say previously you've utilized another NIC for the Guest stuff?

 

On your DHCP server. What are it's NIC settings? IP is 10.103.20.11, but what is the subnet and the gateway?

Edited March 27, 2015 by IrritableTech

[JJonas]

Ok - that sounds to me like the smoothwall either doesn't have the right IP setup on its (v)NIC, or it's not tagged in the right VLAN - probably the latter 'cos I just realised my suggested config didn't account for the SW!

 

 

Ive untagged I24(smoothwall) in the config and I can now ping it, just got to sort out pinging the DHCP server. Do I need to untag the port it is plugged into on the switch and what is the potential for this to stuff things up given it is our Domain controller and main file server?

Edited March 27, 2015 by JJonas

[IrritableTech]

Ive untagged I24(smoothwall) in the config and I can now ping it just got to sort out pinging the DHCP server

 

Excellent. I'm suspecting your servers gateway address is the issue now.

[Davit2005]

Excellent. I'm suspecting your servers gateway address is the issue now.

 

I have always set up similar environments with the dhcp servers gateway set to the ip address of the vlan it is on and this works fine i.e. if on switch vlan 1 ip address 172.25.0.1 default gateway of server would be the same . So I think next step would be to try what @IrritableTech mentions.

Edited March 27, 2015 by Davit2005

[JJonas]

We have made really good progress but hit a stumbling point. The below configuration works if you plug a laptop in via a cable to port J24. This port along with ports I10 and I24 are untagged in the Guest VLAN as we discovered with out this it was not possible to ping the Smoothwall(I24) and DHCP server(I10) without. With this arrangement, the laptop gets an IP address from the new scope on the DHCP server and we can ping everything fine. We cant get out to the Internet at the moment because we need a change on the LEA provided router to allow Smoothwall to process DNS requests. This will hopefully follow soon.

 

If we plug the access point into J24 instead of the laptop and connect to the Guest WLAN(which is tagged to the correct VLAN) it doesn’t get an IP address from DHCP. We have tried a mixture of combinations of having it tagged/untagged but only once were we able to get allocated the correct address but strangely that was when we connected to our corporate WLAN, so we had to quickly revert the changes as this was in use at the time.

 

So the question is how do we get users connected to the GUEST WLAN on this 172.16.1.x network?

 

is it something to do with the fact that the access point NIC is configured with an IP address for our corporate network not the 172.16.1.X network?

 

as always any help greatly appreciated.

 

; J8698A Configuration Editor; Created on release #K.15.02.0005

 

hostname "ProCurve Switch 5412zl"

module 1 type J9537A

module 2 type J9550A

module 3 type J9550A

module 4 type J9550A

module 5 type J9550A

module 6 type J9550A

module 7 type J9550A

module 8 type J9550A

module 9 type J9550A

module 10 type J9550A

interface H18

speed-duplex 100-full

exit

interface J22

speed-duplex 100-full

exit

interface J24

speed-duplex 100-full

exit

ip default-gateway 10.103.20.5

ip routing

vlan 1

name "DEFAULT_VLAN"

untagged A1-A24,B1-B24,C1-C24,D1-D24,E1-E24,F1-F24,G1-G24,H1-H24,I1-I9,I11-I23,J1-J23

ip address 10.103.20.133 255.255.252.0

no untagged I10,I24,J24

exit

vlan 2

name "Guest"

untagged I10,I24,J24

ip helper-address 10.103.20.11

ip address 172.16.1.3 255.255.255.0

exit

[Davit2005]

Glad you are making progress with this, it probably a bit easy now in half term time and no one around

 

It should be a matter of setting up the SSID's to vLAN mapping, sorry a bit rusty as I done that quite a few years ago in a previous employment and no longer have access to the kit to guide you through.

 

Once the SSID is mapped to a vlan and that vlan is tagged on the port on the switch that the access point is plugged into that should be it.

 

You also might need to put the route on the firewall/router so the router can forward the packet back from the internet back to the correct ip, you can use a static route for that. say the core switch is 10.103.20.133 and the subnet 172.16.1.0/24 it would be a static route of 172.16.1.0 255.255.255.0 10.103.20.133 .

[IrritableTech]

Good news @JJonas

 

Yeah the port which your AP is plugged into (J24) should probably be Untagged VLAN 1 and Tagged VLAN 2. On the Ruckus SSID settings page the ACCESS VLAN should be set to 2.

[ronnoco]

Man thanks for the reply.

 

We have already mapped the SSID of the WLAN to the corresponding VLAN but regardless of whether we have the port that the access port is plugged into tagged, untagged, etc - it just wont work. We never get an IP address. Unplug the AP and plug the cable into the laptop and it works just fine.

 

I can't get my head round how the AP can serve both the corporate network (10.103.20.X) and the Guest (172.16.1.X) I know it must be to do with the tagging of the VLAN but can't see what is wrong with our current set-up. We are waiting on the LEA to add that route to the router but they aren't they quickest at processing router change requests.

 

I still think without that route we should be able to get an ip address from the 172.16.1.x scope like the laptop does.

[Davit2005]

We have HP wireless where we are now and it is setup exactly the same way i.e. the port is untagged on the vlan used for management and tagged for the vlans of the different SSID's.

[Davit2005]

Man thanks for the reply.

 

We have already mapped the SSID of the WLAN to the corresponding VLAN but regardless of whether we have the port that the access port is plugged into tagged, untagged, etc - it just wont work. We never get an IP address. Unplug the AP and plug the cable into the laptop and it works just fine.

 

I can't get my head round how the AP can serve both the corporate network (10.103.20.X) and the Guest (172.16.1.X) I know it must be to do with the tagging of the VLAN but can't see what is wrong with our current set-up. We are waiting on the LEA to add that route to the router but they aren't they quickest at processing router change requests.

 

I still think without that route we should be able to get an ip address from the 172.16.1.x scope like the laptop does.

 

It won't effect the laptop getting the IP.

 

The vlan is mapped to the SSID on the ruckus AP's from memory, does the below link help in any way??

 

https://forums.ruckuswireless.com/ruckuswireless/topics/tagging_vlan_per_ssid

[IrritableTech]

Looking at your Ruckus controller...

 

Configure - Access Points - Access point groups. In the port settings area, is your lan port setup as trunk, general or access?

Edited April 1, 2015 by IrritableTech

[ronnoco]

Hi,

 

We have only just this week revisited this little chestnut as I was away at Easter.

 

In answer to the question, we haven't got anything configured, they are all in the system default. I wonder if what I am about to post is related to this now....

 

We have made big steps in getting this working. If we plug a laptop into the core switch and have the port that are we plugging it into untagged to the Guest VLAN, everything works. We get an IP address via the new DHCP scope and we are able to get out to the Internet, DNS appears ok - great news!

 

If we patch the closest Ruckus access point into the same port and connect to the Guest WLAN (set up for now as a standard WLAN) it doesn't work. Just takes longer than usual and then connects with limited connectivity and givbs out a private 169 address and 255.0.0.0 mask.

 

So we know that it's something to do with Ruckus now. We have tried all combinations for tagging which are 1.)untagged to guest, 2.)untagged to default, 3.)tagged to default and 4.)tagged to guest. I will add that one of those options brought down the entire network for 20 minutes until we could resolve (simply untagging didn't seem to work, we had to reboot the switch)

 

So, this is where we are. Any ideas on what we need to do on the Ruckus set-up to get it working? We have defined the correct VLAN ID on the Guest WLAN and like i said, tried all combinations on tagging. Other than that, it's untouched.

 

Many thanks to all that have helped - this has been so much more agg that what I envisaged! - I felt like giving up today when it crashed everything and just doing it the way we have been but no...we must battle on!

[Boredguy]

What vLan assignment and tagging have you got on the switch port that your ZoneDirector is plugged into.

It should be trunked for your BYoD VLan as well as your normal network vLan

 

Your Access points should also have same settings applied.

[ronnoco]

I honestly didn't think about that!

 

At the moment, it is connected to the switch just as any other computer and untagged in the default VLAN.

 

Do I need to run another physical cable from the Controller? (this is what we have done for Smoothwall and DHCP) or do we just need to have it untagged on the Guest VLAN?

 

Many Thanks

[Boredguy]

You don't have to use another cable. On the switch, just tag the Zone Director port for all required vLans.

 

In my case I have vLan 1 and vLan 30 Tagged for the ZD, Access Points and the links between switches so that traffic can be routed through the equipment to it's final destination.

[ronnoco]

This is where I find it confusing. At the moment, to get it working we have ports UNTAGGED. So, in our guest VLAN we have the smoothwall interface and the DHCP sever (which both have separate cables to the core switch and have their interfaces configured with the 172.X address) set as untagged. Also, the port we are connecting he laptop to is untagged.

 

With this method, it works, so would we need the Ruckus Controller UNTAGGED like these? Can it be untagged in VLAN1 and VLAN2? because unlike the other two devices (Smoothwall & DHCP) we would need the Controller accessible on the other subnet.

 

Maybe we're doing it wrong....

[Boredguy]

If you have a single vLan going over a physical cable, then the ports should be untagged. This is so the switch does not add the additional header to the data packet.

 

If you have multiple vLans going over a physical cable, then the ports should be tagged. This is so the switch can add the vLan information to the header of the data packet so it knows to keep it apart.

 

You can try connecting the secondary port on your Zone Director to the switch, and set that vLan to be your BYoD and it should still function exactly the same as having both vLans tagged on a single cable.

[ronnoco]

I don't think I can configure the spare interface on the Ruckus controller to be on the 172.X network like I have done for Smoothwall and DHCP and even if I could, it wouldn't work because the access points themselves are only connected via one cable.

 

Although the way we have done it (by running extra cables to SW & DHCP) works, I think that problem is obviously down to the tagging.

 

Based on what happened this morning, I'm getting very twitchy about tagging/untagging ports, but are you saying the Ruckus access point and controller (which both need to work on VLAN1 & VLAN2) should they be TAGGED in both?

 

If it makes it any clearer, here is our current config. The ports that are untagged are the SW and DHCP interfaces running on the 172.X network. If we also have I24 untagged and connect a laptop, it all works.

 

Many Thanks!

 

interface H18

speed-duplex 100-full

exit

interface J22

speed-duplex 100-full

exit

interface J24

speed-duplex 100-full

exit

ip default-gateway 10.103.20.5

ip routing

vlan 1

name "DEFAULT_VLAN"

untagged A1-A24,B1-B24,C1-C24,D1-D24,E1-E24,F1-F24,G1-G24,H1-H24,I1-I9,I11-I2

3,J1-J23

ip address 10.103.20.133 255.255.252.0

no untagged I10,I24,J24

exit

vlan 2

name "Guest"

untagged I10,I24,J24

ip helper-address 10.103.20.11

ip address 172.16.1.3 255.255.255.0

exit

snmp-server community "public" unrestricted

spanning-tree

no autorun

no dhcp config-file-update

no dhcp image-file-update

password manager

Edited April 22, 2015 by ronnoco

[Boredguy]

The Zone Director does not need an IP address for your Guest vLan, it just has to be able to see packets that are sent from the access point.

 

Although we are not using Smoothwall, our config is like this

 

Core Switch

Port 1 (BYoD DHCP Server) - Untagged vLan 30

Port 2 (Zone Director) - Tagged vLan 1 & vLan 30

Port 3 (PoE Switch) - Tagged vLan 1 & vLan 30

Port 4 (Normal Switch) - Untagged vLan 1

 

PoE Switch

Port 1 (Link to Core Switch) - Tagged vLan 1 & vLan 30

Port 2 (AP1) - Tagged vLan 1 & vLan 30

Port 3 (AP2) - Tagged vLan 1 & vLan 30

[ronnoco]

Thanks!

 

So it would seem we need to take the ZD and Ruckus AP into VLAN1 & VLAN2.

 

When we get the guts, we'll give it a go!

 

Cheers :-)

[Boredguy]

Also ensure that any ports that are linking your core switch to edge switches which have your Access Points plugged into are also tagged for both vLans otherwise the data packets will not make the trip.