gaiacraig

Does this help? Securing Wireless LANs with PEAP and Passwords I've got lots of experience in designing and implementing this so if there's anything that still doesn't make sense just ask away

Glad you got it sorted!

Does this help (particularly the 'Use the DnsUpdateProxy security group' part)... How to configure DNS dynamic updates in Windows Server 2003

If you give a PC on the same subnet a static IP address can you ping the DHCP server?

I think I understand what you're asking... You should create a routed link between the sites. This would mean creating a new subnet purely between the switches/routers which link the sites, or use routed ports on your HP switch (whichever is most suitable) with a small /30 subnet. If you configure IP helpers on each site, they won't really be a problem as the local DHCP server should respond first and offer an IP address. The client should only accept an offer from the remote DHCP server if it doesn't receive one from the local subnet. You won't need to create Superscopes either, as the DHCP server will know the netmask based on its own NIC. Also, you'll need to configure some kind of routing between the two site routers, or configure static routes so each LAN knows the way to the other one (vital for DHCP to be able to service hosts on the remote sites). Hope that makes sense

I'm assuming this is still open, so you can do this a couple of ways... 1] If there is a Cisco device at BOTH ends, use a tunnel interface at each router to send traffic via the IPSec VPN. This way you just add a route statement to send all traffic via the Tunnel interface. 2] Look at this... https://supportforums.cisco.com/thread/2045344 The article at Cisco's Support Forums describes exactly what you need if the ISP doesn't have a Cisco router at the other end of the link. Hope that helps!

As I said, all devices on VLAN1 would have Router1 set as their default gateway, so ARP would resolve the MAC of Router1 (We're not using proxy-arp where the clients don't have a gateway configured). In order to allow devices on VLAN1 to see devices on the other VLANs they need to know how to get to them, but as they're not using the router which deals with the other VLANs (the HP switch) as their default gateway they have to rely on Router1 to tell them (via the static route we configured and IP redirect). IP Redirect will tell the clients to use the IP address on the HP switch directly instead of routing traffic via Router1. This explains a little... Explanation of ICMP Redirect Behavior Make sense?

No, they would just be gateways. However I do see where I was unclear. The only connection between the network and Router2 would be on the new VLAN, so the existing VLANs configured on Router 2 would be removed and the HP switch would now be the router for ALL VLANs - it would adopt the IP addresses we removed from Router2. As the static route on the HP switch is just a default route it would only route traffic to destinations where a valid route doesn't already exist on the HP switch. In turn, the HP switch would only send traffic to external networks to Router2.

@Mehmet - what cpjitservices means is that the Phone vendor told him that the Phone System doesn't have any VLAN capability. I get this all the time - CCTV, BMS, Cashless Catering - they all tell me their kit doesn't support VLANs or even work on VLANs sometimes. Usually it's because they've either misunderstood what we're saying, or they don't know what a VLAN is, or because they don't want to deal with any support issues over a routed network should they arise.

Try these.... TP-LINK TL-WN722N Don't use the connection software that comes with it - just use the Windows Wireless Service so they should connect as soon as the network connections become active pre-login. Also it comes with an external antenna so no need for the cable :-)

Create a new VLAN on the HP switch and connect router2 to that VLAN. Give Router2 an IP of 192.168.255.1/255.255.255.252 and the HP switch 192.168.255.2 / 255.255.255.252. Configure a static default route on the HP switch to point to Router2's IP address. That will route all VLANs via Router2. Leave Router1 connected to VLAN1 and set all devices on VLAN1 to use Router1 as its default gateway (it sounds like that's what you already have). Put a static route on both routers to point each one back to the rest of the LAN via the HP switch's address on the relevant VLAN, so Router1 would have a static route pointing 192.168.0.0 / 255.255.0.0 to 192.168.60.2. Router2 would have a static route pointing 192.168.0.0 / 255.255.0.0 to 192.168.255.2. You'll also need to enable IP redirects on the routers and HP switch if they support it.

It looks as though you've done everything right. On the NPS server you need to look in Custom Logs, not the Windows Logs (you won't see anything from NPS in there). You should see plenty of logs if you're trying to get a client to associate using Computer Authentication. Can you have a look in the log and post any errors you get here?