VLAN Confusion

[Divaldo]

I'm trying to create a new VLAN for our Year 11's (VLAN 50), and have the devices obtain DHCP addresses from a specific scope.

 

I've got the Ruckus AP plugged directly into our core switch on port B3, and the following configured on the switch:

 

ip route 0.0.0.0 0.0.0.0 10.56.132.1

ip routing

 

 

vlan 1

name "DEFAULT_VLAN"

untagged A1-A24,B1-B24,C1-C24,D1-D24,E1-E24,F1-F24

ip address 10.56.132.32 255.255.252.0

exit

 

vlan 10

name "Wifi_Stu"

tagged

A1-A3,A5,A7,A9,A13,A18-A19,A21,B1,B3,B19-B21,C1,C3-C9,C11-C12,C14-C15,C19,C24,D1-D3

,D5,D7,D10-D11,D22,E1-E4,F1-F4,F12,F23-F24

ip address 10.56.128.1 255.255.254.0

ip helper-address 10.56.132.8

exit

 

vlan 20

name "Wifi_BYOD"

tagged

A1-A3,A5,A7,A9,A13,A18-A19,A21,B1,B3,B19-B21,C1,C3-C9,C11-C15,C19,C22-C24,D1-D3,D5,

D7,D10-D11,D22,E1-E4,F1-F4,F12,F23-F24

ip address 10.56.130.1 255.255.255.0

ip helper-address 10.56.132.8

exit

 

 

vlan 50

name "Year11-BYOD"

tagged

A1-A3,A5,A7,A9,A12-A13,A18-A19,A21,B1,B3,B19-B21,C1,C3-C9,C11-C12,C14-C15,C19,C24,D

1-D3,D5,D7,D10-D11,D22,E1-E4,F1-F4,F12,F23-F24

ip address 10.56.136.1 255.255.255.0

ip helper-address 10.56.132.8

exit

 

The other vlans on the switch work fine and can get a DHCP address from their own scopes on the DHCP server, they were set up by my predecessor and from what i can see, look the same as what i've done.

 

Our DHCP server is 10.56.132.8, and it has a scope for 10.56.136.0 configured.

start IP address = 10.56.136.10

end IP address = 10.56.136.254

 

As far as I can see, this is the same as the scopes for the other VLANs, but with different ranges specified.

 

Within Ruckus zone director, the WLAN has the vlan tag of 50 configured in its advanced options.

 

The SSID is being broadcast fine from the AP, but i only get a 169.254.x.x APIPA address. I've configured another port on the switch as tagged on vlan 50 and if i connect a cable from there to my laptop i can ping 10.56.136.1, but i'm getting a DHCP address on a different range.

 

If i specify a static IP on my laptop of 10.56.136.10 255.255.255.0, i can't connect to, or ping anything.

 

Can anyone see what i'm missing please?

[Divaldo]

oh and i have got the DHCP server (10.56.132.8) set up as a dhcp relay in zone director, it works as devices on the other VLANs get addresses

[fiza]

In your new DHCP scope (VLAN 50) have you given it a Router address of the VLAN ie 10.56.136.1

[Divaldo]

thanks for the quick reply fiza.

 

yes, in the scope options i have got:

router - 10.56.136.1

 

i've specified two DNS servers and the DNS domain name too.

 

From the DHCP server, I can ping 10.56.136.1

 

- - - Updated - - -

 

on the core switch, i can ping the DHCP server.

[Divaldo]

I've tried setting another port on the switch to be untagged and tried again with it tagged for VLAN 50, and if i connect my laptop to that with a static ip address of 10.56.136.10 255.255.255.0, i cannot ping 10.56.136.1 or anything else.

[fiza]

Hopefully @FN-GM can help?

[keithu]

Your laptop needs to be plugged into an untagged vlan 50 port for testing. If you get a DHCP address from your new range you'll know the problem is on the WiFi side.

[Divaldo]

thank you keithu - you're right. I set my test port to untagged and got an IP address from the correct range! thanks.

 

So where do i begin troubleshooting the wireless side?

[Divaldo]

i changed my test port back to 'tagged' and plugged the AP in there, it broadcast the SSID, but when i connect, i still get no IP address.

 

Guess it must be a Ruckus thing?

[keithu]

I'm not familiar with Ruckus but as long as you are getting authenticated and the SSID is associated with VLAN 50 I would have thought it should work.

 

Maybe try clearing and reloading the configuration on the AP in case it has got messed up?

[Divaldo]

cool, cheers. Yeah I am new to ruckus as well.

 

If i set it to password authentication, i can authenticate but then get no IP address, but i'm configuring it as captive portal. I never get a login page presented to me.

 

I'll keep googling for ruckus help.

 

Thanks for your time.

[Davit2005]

So on the Ruckus you have configured the SSID to use vlan 50?

 

It has been about 6-7 years since I setup a Ruckus WiFi with different vlans though and have not worked with one since.

 

Don't have both vlan 50 untagged and tagged on the same port. Might get confusing.

Edited April 17, 2018 by Davit2005

[Divaldo]

yes Davit, thanks. In the advanced settings of the WLAN (or SSID), I have got 'Access VLAN' set as 50. I think Access VLAN is Ruckus terminology.

 

I can't see anything else relating to VLANs in zone director.

[Davit2005]

yes Davit, thanks. In the advanced settings of the WLAN (or SSID), I have got 'Access VLAN' set as 50. I think Access VLAN is Ruckus terminology.

 

I can't see anything else relating to VLANs in zone director.

 

They can be a bit muddling :-( .

 

Can I also confirm that the DHCP server has the CoreSwitch as its gateway?

 

There are not any ACL's configured on the switch either.

 

Have you tried pinging the ip address of the vlan 50 subnet 10.56.136.1 from your DHCP server.

 

I'm a bit lost now if so :-( .

Edited April 17, 2018 by Davit2005

[fiza]

yes Davit, thanks. In the advanced settings of the WLAN (or SSID), I have got 'Access VLAN' set as 50. I think Access VLAN is Ruckus terminology.

 

I can't see anything else relating to VLANs in zone director.

 

We have the VLAN ID set in exactly the same place in our Ruckus.

[Divaldo]

thanks guys.

 

I think i'm getting somewhere, the AP had its default gateway set as 10.56.132.32 (the core switch), but when I changed that to be 10.56.132.1 (the default VLAN address), things started working. My phone wirelessly gets an IP on the correct DHCP range.

 

My only problem now is that the captive portal is telling me i'm not authorised to access the WLAN after I've logged in with my username and password, despite my AD account being a member of the correct group. But that's a separate issue!

 

 

Thank you

[ITGuyWestMidlands]

Do a show run config on your switch and see if you have any ACLS in place. I'd expect you do as your byod would have access to your other networks otherwise.