Autonomous AP as WGB (Single VLAN)

In this post we will learn how to configure an autonomous AP as WGB.

WGB can provide the wired connection to the devices which don’t have wireless adaptor so that device can directly connect to WGB Ethernet port to access the wireless network.

It can provide wireless connectivity to wired clients that are connected by Ethernet to the work-group bridge access point.00

WGB connect to root AP as a client through the wireless interface.

Basic Info:

  • Infrastructure SSID configuration not required
  • By default when the WGB associates with the root bridge, all the wired clients + the WGB are shown as normal clients.
  • A WGB can only pass one VLAN between the WGB and the root bridge(As Cisco recommend but it can also pass multiple)
  • Always use bridge-group 1 for the link between the root and WGB.
  • But if we use WGB multicast infrastructure mode on the WGB, we need to add infrastructure-client on the root AP side.
  • A WGB in standard mode is by default a “client”, not an “infrastructure client” and therefore cannot associate to an infrastructure SSID.
  • WGB is a mobile
  • Root AP can allow max 20WGB.(This must be test out)

 My Topology:

WGB_Vlan1

Remembering Points:

  1. The AP to which a WGB associates can treat the WGB as an infrastructure device or as a normal client. By default, AP treats WGB as client devices.
  1. If WGB is an infrastructure client, it can associate to an infrastructure SSID. Infrastructure SSIDs are used to authenticate Bridges, Repeaters…Etc. A WGB in by default is a “client”, not an “infrastructure client” and therefore cannot associate to an infrastructure SSID.

Use of Infrastructure-Client Command:

  1. Used for Reliable Multicast
  2. To make WGB as Infrastructure-Client so that WGB can associate to Infrastructure-SSID.

In my example WGB is connected root AP via RSCCIEW WLAN interface.

WGB authentication with LEAP-WPA2.

Here is the configuration:

Root AP:

RootAP#sh run
 !
 hostname RootAP
 !
 aaa new-model
 !
 aaa group server radius rad_eap
 server 192.168.11.35 auth-port 1112 acct-port 1113
 !
 aaa authentication login eap_method group rad_eap
 !
 dot11 ssid RSCCIEW
 vlan 11
 authentication open eap eap_method
 authentication network-eap eap_method
 authentication key-management wpa version 2
 !
 interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption vlan 11 mode ciphers aes-ccm
 !
 ssid RSCCIEW
 !
 station-role root
 !
 interface Dot11Radio0.11
 encapsulation dot1Q 11 native
 no ip route-cache
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
 !
 interface Dot11Radio1
 no ip address
 no ip route-cache
 shutdown
 no dfs band block
 channel dfs
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
 !
 interface FastEthernet0
 ip address dhcp
 no ip route-cache
 speed 100
 full-duplex
 !
 interface FastEthernet0.11
 encapsulation dot1Q 11 native
 no ip route-cache
 bridge-group 1
 no bridge-group 1 source-learning
 bridge-group 1 spanning-disabled
 !
 interface BVI1
 ip address 192.168.11.35 255.255.255.0
 no ip route-cache
 !
 ip default-gateway 192.168.11.254
 radius-server local
 no authentication eapfast
 no authentication mac
 nas 192.168.11.35 key 7 13261E010803557878
 user WGB nthash 7 124C264F425B2A55790A770B166D743623445655067D7C077159504B477C017601
 !
 radius-server host 192.168.11.35 auth-port 1112 acct-port 1113 key 7 02250D4808095E731F
 bridge 1 route ip
 !
 end

WGB:

WGB#sh run
 !
 hostname WGB
 !
 no aaa new-model
 !
 dot11 ssid RSCCIEW
 authentication open eap test
 authentication network-eap test
 authentication key-management wpa version 2
 dot1x credentials wgbuser
 dot1x eap profile leap
 !
 eap profile leap
 method leap
 !
 dot1x credentials wgbuser
 username WGB
 password 7 060506324F41
 !
 interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption mode ciphers aes-ccm
 !
 ssid RSCCIEW
 !
 station-role workgroup-bridge
 bridge-group 1
 !
 interface Dot11Radio1
 no ip address
 no ip route-cache
 shutdown
 no dfs band block
 channel dfs
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
 !
 interface FastEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
 bridge-group 1
 !
 interface BVI1
 ip address dhcp
 no ip route-cache
 !
 bridge 1 route ip
 bridge 1 address c434.6b27.0c11 forward FastEthernet0.11
 !
 end

Verification:

On Root AP

RootAP#sh dot11 associations
 802.11 Client Stations on Dot11Radio0:
 SSID [RSCCIEW] :
 MAC Address    IP address      Device        Name            Parent         State
 001d.7096.3404 192.168.11.36     WGB           WGB             self           EAP-Assoc
 c434.6b27.0c11 192.168.11.37     WGB-client    -               001d.7096.3404 Assoc
RootAP#sh dot11 associations 001d.7096.3404
 Address           : 001d.7096.3404     Name             : WGB
 IP Address        : 192.168.11.36        Interface        : Dot11Radio 0
 Device            : WGB                Software Version : 12.4
 CCX Version       : 5                  Client MFP       : On
 State             : EAP-Assoc          Parent           : self
 SSID              : RSCCIEW
 VLAN              : 11
 Hops to Infra     : 1                  Association Id   : 1
 Clients Associated: 1                  Repeaters associated: 0
 Tunnel Address    : 0.0.0.0
 Key Mgmt type     : WPAv2              Encryption       : AES-CCMP
 Current Rate      : 54.0               Capability       : WMM ShortHdr ShortSlot
 Supported Rates   : 1.0 2.0 5.5 11.0 6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0
 Voice Rates       : disabled           Bandwidth        : 20 MHz
 Signal Strength   : -24  dBm           Connected for    : 102 seconds
 Signal to Noise   : 71  dB            Activity Timeout : 30 seconds
 Power-save        : Off                Last Activity    : 0 seconds ago
 Apsd DE AC(s)     : NONE
 Packets Input     : 213                Packets Output   : 29
 Bytes Input       : 47472              Bytes Output     : 3382
 Duplicates Rcvd   : 0                  Data Retries     : 3
 Decrypt Failed    : 0                  RTS Retries      : 0
 MIC Failed        : 0                  MIC Missing      : 0
 Packets Redirected: 0                  Redirect Filtered: 0
 Session timeout   : 0 seconds
 Reauthenticate in : never
RootAP#sh dot11 associations c434.6b27.0c11
 Address           : c434.6b27.0c11     Name             : NONE
 IP Address        : 192.168.11.37        Interface        : Dot11Radio 0
 Device            : WGB-client         Software Version : NONE
 CCX Version       : NONE               Client MFP       : Off
 State             : Assoc              Parent           : 001d.7096.3404
 SSID              : RSCCIEW
 VLAN              : 11
 Hops to Infra     : 0
 Clients Associated: 0                  Repeaters associated: 0

On WGB:

 *Mar  1 02:06:37.718: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP RootAP 003a.9a3e.a380 [LEAP WPAv2]
  
  
 WGB#sh dot11 associations
 802.11 Client Stations on Dot11Radio0:
 SSID [RSCCIEW] :
 MAC Address    IP address      Device        Name            Parent         State
 003a.9a3e.a380 192.168.11.35     ap1240-Parent RootAP          -              EAP-Assoc
  
 WGB#sh dot11 associations 003a.9a3e.a380
 Address           : 003a.9a3e.a380     Name             : RootAP
 IP Address        : 192.168.11.35        Interface        : Dot11Radio 0
 Device            : ap1240-Parent      Software Version : 12.4
 CCX Version       : 5                  Client MFP       : On
 State             : EAP-Assoc          Parent           : -
 SSID              : RSCCIEW
 VLAN              : 0
 Hops to Infra     : 0                  Association Id   : 1
 Tunnel Address    : 0.0.0.0
 Key Mgmt type     : WPAv2              Encryption       : AES-CCMP
 Current Rate      : 54.0               Capability       : WMM ShortHdr ShortSlot
 Supported Rates   : 1.0 2.0 5.5 11.0 6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0
 Voice Rates       : disabled           Bandwidth        : 20 MHz
 Signal Strength   : -28  dBm           Connected for    : 177 seconds
 Signal to Noise   : 66  dB            Activity Timeout : 11 seconds
 Power-save        : Off                Last Activity    : 4 seconds ago
 Apsd DE AC(s)     : NONE
 Packets Input     : 2475               Packets Output   : 732
 Bytes Input       : 402607             Bytes Output     : 316070
 Duplicates Rcvd   : 0                  Data Retries     : 4
 Decrypt Failed    : 0                  RTS Retries      : 0
 MIC Failed        : 0                  MIC Missing      : 0
 Packets Redirected: 0                  Redirect Filtered: 0

Passive Client Feature

In this post we will learn about the passive client feature.

My Real Problem Scenario:

From last 2 weeks I am facing problem with a device connected behind a WGB. This device has static IP address.

I tried before 2 weeks and it was working but now it’s not. I don’t know what was wrong.

So on one hand it is working (At one place) – Did not enable passive client , still working

On other hand it’s not working (on another location) – Enable passive client and its working

So let’s deep drive in to this topic:

What is passive client?

Passive clients are wireless devices, such as printers, machine that are configured with a static IP address. These types of clients do not transmit any IP information when they associate with an AP. As a result, the WLC never knows the IP address unless they use the DHCP.

Must Remembering Points:

  • This feature is not supported with the AP groups and HREAP (Flex-Connect) centrally switched WLANs
  • This feature works in multicast-multicast and multicast-unicast The controller sources the multicast packets using its management IP address.
  • Earlier it was only supported on Cisco 5500 and Cisco 2100 Series Controllers but now 2504 WLC also supported.

WLCs act as a proxy for ARP requests. Upon receiving an ARP request, the controller responds with an ARP response instead of passing the request directly to the client. This scenario has two advantages:

  • The upstream device that sends out the ARP request to the client will not know where the client is located.
  • Power for battery-operated devices such as mobile phones and printers is preserved because they do not have to respond to every ARP requests.

The passive client feature enables the ARP requests and responses to be exchanged between wired and wireless clients. This feature, when enabled, allows the controller to pass ARP requests from wired to wireless clients until the desired wireless client gets to the RUN state.

How to configure:

  • Enable multicast-multicast mode
  • Enable the global multicast mode
  • Enabling the Passive Client Feature

Via GUI:

Enable Multicast-Multicast mode:

Controller > General, Select AP multicast mode and put the Multicast Group IP address and then Apply.

Passive1

Enable the Global Multicast Mode:

Choose Controller > Multicast, select both the boxes and then Apply

Passive2

Enable the Passive Client Feature:

Choose WLANs > WLANs > WLAN ID to open the WLANs > Edit page

Go to Advanced tab, Select the Passive Client box and then Apply

Passive3

Via CLI:

Enable multicast-multicast mode:

(WLC1) >config network multicast ?
 global         Enter mode.
 igmp           Igmp paratemers set
 l2mcast        Configuration of L2 Multicast
 mode           Configure WLC to AP Multicast/Broadcast traffic forwarding mode.
(WLC1) >config network multicast mode ?
 multicast      Mcast/Bcast Packets are encapsulated in multicast CAPWAP tunnel to APs
(WLC1) >config network multicast mode multicast ?
 <IP addr>      Mcast/Bcast Packets are encapsulated in multicast CAPWAP tunnel to APs
(WLC1) >config network multicast mode multicast 239.239.35.1

Enable the global multicast mode:

(WLC1) >config network multicast global ?
 enable         Enables this setting.
 disable        Disables this setting.
(WLC1) >config network multicast global enable
(WLC1) >config network multicast igmp ?
 query          Igmp Query paratemers set
 snooping       Igmp snooping configuration
 timeout        Igmp timeout set
(WLC1) >config network multicast igmp snooping ?
 enable         Enable Igmp snooping
 disable        Disable Igmp snooping
(WLC1) >config network multicast igmp snooping enable

Enabling the Passive Client Feature:

(WLC1) >config wlan passive-client enable ?
 <WLAN id>      Enter WLAN Identifier between 1 and 16.
(WLC1) >config wlan disable 8
(WLC1) >config wlan passive-client ?
 disable        Disable passive-client feature on a WLAN.
 enable         Enable passive-client feature on a WLAN.
(WLC1) >config wlan passive-client enable 8

Verification:

(WLC1) >show wlan 8
 .
 WLAN Identifier.................................. 8
 Profile Name..................................... Test
 Network Name (SSID).............................. test
 .
 .
 .
 IPv6 Support..................................... Disabled
 Passive Client Feature........................... Enabled
 Peer-to-Peer Blocking Action..................... Disabled
(WLC1) >

That’s all, now my Passive device is working 🙂