HP Switches and Aerohive BYOD

[edsa131]

Hi everyone

 

I am looking at implementing a BYOD solution for our Sixth Form. I have installed 4 Aerohive AP230s and will use Hive Manager Cloud Management to manage the wireless network side of the solution.

 

I have the following resources:

 

 

1 HP Switch 5406zl (J8697A) (Core)

1 HP 2530-48G-PoEP Switch (J9772A) (Edge - Sixth Form)

4 Aerohive AP230 Access Points

1 Aerohive Hive Manager

1 Microsoft Network Policy Server (RADIUS)

1 Smoothwall UPS S8 Appliance

 

 

The two switches are linked by a 1GB fibre connection.

 

 

I have created 2 VLANs: VLAN 10 and VLAN 20

 

 

VLAN 10 is named CORP_VLAN for Teachers and Staff access

VLAN 20 is named BYOD _VLAN for BYOD traffic internet access only

 

 

I have a RADIUS Server setup to use 802.1x Windows Authentication for both VLANs

 

 

On the core switch B3 connects to port 49 of the Edge switch and this is the fibre uplink connection.

 

 

The configuration of the 2 switches is as follows:

 

 

Core Switch: VLAN 1 Default_VLAN (Primary)

 

 

IP Address: 10.1.0.23

SM: 255.255.0.0

GW: 10.1.0.19

Ports Tagged: None

Ports Untagged: A1-A9,A11-A24,B1-B24,C1-C24

 

 

Core Swtich: VLAN 10 CORP_VLAN

 

 

IP Address: 10.6.0.10

SM: 255.255.0.0

GW: 10.1.0.19

Ports Tagged: B3

Ports Untagged: None

 

 

Core Switch VLAN 20 BYOD_VLAN

 

 

IP Address: 10.5.0.10

SM: 255.255.0.0

GW: 10.1.0.19

Ports Tagged: B3

Ports Untagged: None

 

 

Sixth Form Switch VLAN 1 Default_VLAN (Primary)

 

 

IP Address: 10.1.0.197

SM: 255.255.0.0

GW: 10.1.0.19

Ports Tagged: None

Ports Untagged: 1-24 29-52

 

 

Sixth Form Switch VLAN 10 CORP_VLAN

 

 

IP Address: 10.6.0.10

SM: 255.255.0.0

GW: No Gateway

Ports Tagged: 49

Ports Untagged: 25-28

 

 

Sixth Form Switch VLAN 20 BYOD_VLAN

 

 

IP Address: 10.5.0.10

SM: 255.255.0.0

GW: No Gateway

Ports Tagged: 49

Ports Untagged: 25-28

 

 

DHCP Config:

 

 

Scope 10.1.0.0 (Default Scope | Default_VLAN)

Address Pool: 10.1...0.0 - 10.1.20.254

Router: 10.1.0.23 (Core Switch)

DNS Servers: 10.1.0.125, 10.1.0.126

Domain Name: acaciahighschool.local

 

 

Scope 10.5.0.0 (BYOD_VLAN)

Address Pool: 10.5.0.50 - 10.5.20.254

Router: 10.5.0.10

DNS Servers: 10.1.0.125, 10.1.0.126

Domain Name: acaciahighschool.local

 

 

Scope 10.6.0.0 (CORP_VLAN)

Address Pool: 10.6.0.50 - 10.6.20.254

Router: 10.6.0.10

DNS Servers: 10.1.0.125, 10.1.0.125

Domain Name: acaciahighschool.local

 

 

The APs are all recieving IP addresses from VLANs 10 and 20, but when probing for VLANs from the AP230s they cannot find any VLAN apart from the Default_VLANs

 

 

My question is does the switching and routing look consistent and correct in combination with the DHCP scopes that are setup for the associated VLANs.

 

 

I would really appreciate some expert guidance on this

[foofighterjim]

Just a bit of best practice that may help you, your Aerohive APs really should be in their own "management" VLAN with a separate scope in DHCP. The ports the APs are connected to would need to be Untagged on your switch for that VLAN and you would need to tell HMOL what VLAN they are on. This will help as your RADIUS server will need the IP address of each Aerohive AP as authentication happens at the edge with Aerohive (This is where a separate scope really helps).

 

I will read your post in a little more detail later to see if I can see anything wrong (unless someone comes back to you first).

 

Edit: Just noticed your VLANs are all using /16 subnets. These are extremely large broadcast domains and I am sure it will give you problems going forward, you really need to use smaller subnets. Especially as the point to VLANs is to break the network up, you can keep your scope spacing for future expansion just reduce the subnets and adjust the scopes accordingly.

Edited November 29, 2016 by foofighterjim

[edsa131]

Many thanks for the reply, this is the first time I have had the need to configure VLANs etc. Although I know their purpose and importance putting them into practice has been challenging.

[foofighterjim]

Do you have a drawing of this setup, it is quite hard to piece together?

 

However here are a few observations:

 

I presume that 10.6.0.10, 10.5.0.10 are static IP addresses for your core switch on the respective VLANs? If so then DHCP looks ok (other than the large subnets).

 

Have you confirmed that your VLANs are set correctly (before involving DHCP)? I.E. if you plug a device into a port on your 2530 with a static IP from the BYOD_VLAN range and set this port to Untagged, can you ping the Core switch and DHCP server?

 

Your CORP_VLAN has the same DNS IP specified twice.

 

You list your Smoothwall in the list but don't say how or where it is connected to the network? Has it been configured with interfaces for each VLAN?