In this post we will see how to configure a WGB for multiple VLAN in unified wireless environment. This is useful when we want to have wired client behind WGB in different VLAN.
WGB connects to a wired network over a single wireless segment by learning the MAC address of its wired clients on the Ethernet interface and reporting them to the lightweight access point using Internet Access Point Protocol (IAPP) messaging. The WGB provides wireless access connectivity to wired clients by establishing a single connection to the lightweight access point. The lightweight access point treats the WGB as a wireless client.
Remembering Points:
- The workgroup bridge can be any autonomous access point that supports the workgroup bridge mode and is running Cisco IOS Release JA or greater (on 32-MB access points) or Cisco IOS Release 12.3(8) JEB or greater (on 16-MB access points).
- On the wireless LAN controller, we should have software version 4.1.185.0 or later. The WGB mode is not supported on the controller on any of the earlier versions.
- We do not need to configure anything on the controller to enable the WGB to communicate with the lightweight access point. However, to ensure proper communication, we should create a WLAN on the controller that matches the SSID and security method that was configured on the WGB.
- LAP is acting as root AP for WGB.
- We can only configure one radio for WGB mode to connect to LAP.
- By default, access points treat workgroup bridges as client device.
- WGB can support maximum 20 clients.
- These lightweight features are supported for use with a workgroup bridge:
- Guest N+1 redundancy
- Local EAP
- These lightweight features are not supported for use with a workgroup bridge:
- Cisco Centralized Key Management (CCKM)
- Hybrid REAP
- Idle timeout
- Web authentication
- These features are not supported for wired clients connected to a workgroup bridge:
- MAC filtering
- Link tests
- Idle timeout
My topology for this LAB:
Core Switch——-WLC——-LAP~~~~~~~~~~WGB———–Switch——Client
- The Dynamic Host Configuration Protocol (DHCP) is configured for VLAN 80(On Core Switch) and 81(On WLC).
- The WLC has the dynamic interfaces created for VLAN 80 and 81.
- The WGB has sub-interfaces for required VLANs — 80 and 81.
- The switch behind the WGB has required VLANs — 80 and 81.
- WLC is connected with trunk port to Core switch and AP001 (LAP) is connected with access port.
- WLC1 is configured with 2 dynamic interfaces: 80(Test) and 81(Coding)
- Created a SSID”Test” with WPA2/AES – PSK as shown below.
Config. on Core Switch:
First we have to create DHCP pool and SVI interface for the management VLAN so that LAP and WGB can get the IP address. Here I created DHCP Pool “WGB” for VLAN 80 and configured the WLC and AP port with right configuration as shown below.
ip dhcp excluded-address 10.35.80.1 10.35.80.100 ip dhcp excluded-address 10.35.80.120 10.35.80.254 ! ip dhcp pool WGB network 10.35.80.0 255.255.255.0 default-router 10.35.80.254 option 43 ip 10.35.80.1 lease 3 ! vlan 80 name Management ! vlan 81 name coding ! interface FastEthernet1/24 description LAP - AP001 switchport access vlan 80 switchport mode access ! interface FastEthernet0/25 description *** WLC1 *** switchport trunk encapsulation dot1q switchport trunk allowed vlan 80,81 switchport mode trunk ! interface Vlan80 ip address 10.35.80.245 255.255.255.0
Configuration on WLC:
WLAN Configuration:
Step1: As shown in pic, I created a SSID Test with WPA2-PSK security policy and management interface assigned to it.
Step2: DHCP Scope for VLAN 81:
Wired client behind the WGB will get the IP from VLAN 81 so we have to create a DHCP scope for them in WLC.
Step3: Also enable the WGB by WLC CLI:
(WLC1) >config wgb vlan enable
By default its disabled and we must enable it to get WGB VLAN client connectivity.
Config of WGB:
- I am using the WGB to configured for the 2.4-GHz and that is 802.11b radio is 0. (We can only configure one radio for WGB mode to connect to LAP).
- To support multiple VLAN on WGB we have to use VLAN tagging feature which enables segregation of VLAN traffic based on the VLAN numbers for Unified WGB solution. When this feature is enabled, the WGB removes the 802.1q header while sending the packet from a VLAN client to the wireless LAN controller (WLC). WGB gets the packet to a VLAN client without 802.1q header and WGB code has to be modified to add the 802.1q header while forwarding the frame to the switch behind WGB.
WGB updates the WLC with the wired-client VLAN information in the Internet Access Point Protocol (IAPP) Association message. WLC treats the WGB client as a VLAN-client and forwards the packet in the right VLAN interface based on the source-mac-address.
In the upstream direction, WGB removes the 802.1q header from the packet while sending to the WLC.
In the downstream direction while forwarding the packet to the switch connecting the wired-client, the WLC sends the packet to WGB without the 802.1q tag and WGB adds a 4-byte 802.1q header based on the destination mac-address.
To enable VLAN tagging, we have to use this command:
(WLC1) > workgroup-bridge unified-vlan-client
- If you faced this kind of problem while testing: When wired client got connection to WGB but after sometime it automatically removed because of extended of time(specially the connected switch to WGB was losing IP address). To stop this we have to configure aging time on WGB. By using this command:
(WLC1) > bridge brige-group-number aging-time 65535
So here is the complete config for WGB:
hostname WGB ! dot11 ssid Test vlan 80 authentication open authentication key-management wpa version 2 guest-mode wpa-psk ascii 7 105A0C0A114640585851 ! interface Dot11Radio0 no ip address no ip route-cache ! encryption vlan 80 mode ciphers aes-ccm ! ssid Test ! station-role workgroup-bridge --> To define the role of this AP as WGB ! interface Dot11Radio0.80 encapsulation dot1Q 80 native no ip route-cache bridge-group 1 ! interface Dot11Radio0.81 encapsulation dot1Q 81 no ip route-cache bridge-group 81 ! interface Dot11Radio1 no ip address no ip route-cache shutdown ! interface FastEthernet0 no ip address no ip route-cache speed 100 full-duplex ! interface FastEthernet0.80 encapsulation dot1Q 80 native no ip route-cache bridge-group 1 ! interface FastEthernet0.81 encapsulation dot1Q 81 no ip route-cache bridge-group 81 ! interface BVI1 ip address dhcp no ip route-cache ! ip default-gateway 10.35.80.254 ! workgroup-bridge unified-vlan-client --> To support multiple VLAN on WGB
Verification:
On WGB:
WGB#sh bridge Total of 300 station blocks, 293 free Codes: P - permanent, S - self Bridge Group 1: Address Action Interface Age RX count TX count 0022.bd98.3a30 forward Vi0.80 2 3 0 381c.1a89.f4c1 forward Fa0.80 2 12 2 381c.1a89.f481 forward Fa0.80 0 654 0 001e.4a81.4c96 forward Vi0.80 0 386 4 Bridge Group 81: 381c.1a89.f4c2 forward Fa0.81 3 1 0 c434.6b25.80c8 forward Fa0.81 0 2352 0 381c.1a89.f481 forward Fa0.81 0 316 0
WGB#sh dot11 associations 802.11 Client Stations on Dot11Radio0: SSID [Test] : MAC Address IP address Device Name Parent State 0022.bd98.3a32 10.35.80.1 LWAPP-Parent AP001 - Assoc
WGB#sh dot11 associations 0022.bd98.3a32 Address : 0022.bd98.3a32 Name : AP001 IP Address : 10.35.80.1 Interface : Dot11Radio 0 Device : LWAPP-Parent Software Version : NONE CCX Version : 5 Client MFP : On State : Assoc Parent : - SSID : Test VLAN : 80 Hops to Infra : 0 Association Id : 1 Tunnel Address : 0.0.0.0 Key Mgmt type : WPAv2 PSK Encryption : AES-CCMP Current Rate : 54.0 Capability : WMM ShortHdr ShortSlot Supported Rates : 1.0 2.0 5.5 11.0 6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0 Voice Rates : disabled Bandwidth : 20 MHz Signal Strength : -46 dBm Connected for : 989 seconds Signal to Noise : 43 dB Activity Timeout : 15 seconds Power-save : Off Last Activity : 0 seconds ago Apsd DE AC(s) : NONE Packets Input : 672848 Packets Output : 66093 Bytes Input : 128614720 Bytes Output : 6258031 Duplicates Rcvd : 0 Data Retries : 3361 Decrypt Failed : 0 RTS Retries : 425 MIC Failed : 0 MIC Missing : 0 Packets Redirected: 0 Redirect Filtered: 0
ON WLC:
Via GUI:
Client got the IP in VLAN 81 ,which is connected with Switch.
Via CLI:
(WLC1) >show wgb summary WGB Vlan Client Support.......................... Enabled Number of WGBs................................... 1 MAC Address IP Address AP Name Status WLAN Auth Protocol Clients ----------------- --------------- ----------------- --------- ---- ---- ---------------- ------- 58:8d:09:03:e3:1c 10.35.80.110 AP001 Assoc 3 Yes 802.11g 2
(WLC1) >show wgb detail 58:8d:09:03:e3:1c Number of wired client(s): 2 MAC Address IP Address AP Name Mobility WLAN Auth ----------------- --------------- ----------------- ---------- ---- ---- c4:34:6b:25:80:c8 10.35.81.32 AP001 Local 3 Yes 38:1c:1a:89:f4:c1 10.35.80.108 AP001 Local 3 Yes
(WLC1) >show client summary
Number of Clients................................ 3
MAC Address AP Name Status WLAN Auth Protocol Port Wired
----------------- ----------------- ------------- -------------- ---- ---------------- ---- -----
38:1c:1a:89:f4:c1 AP001 Associated 3 Yes N/A 1 N/A
58:8d:09:03:e3:1c AP001 Associated 3 Yes 802.11g 1 N/A
c4:34:6b:25:80:c8 AP001 Associated 3 Yes N/A 1 N/A
(WLC1) >show client detail 58:8d:09:03:e3:1c --> My WGB Client MAC Address............................... 58:8d:09:03:e3:1c Client Username ................................. N/A AP MAC Address................................... 00:22:bd:98:3a:30 AP Name.......................................... AP001 Client State..................................... Associated Client NAC OOB State............................. Access Workgroup Bridge................................. 2 client(s) Wireless LAN Id.................................. 3 BSSID............................................ 00:22:bd:98:3a:32 Connected For ................................... 900 secs Channel.......................................... 1 IP Address....................................... 10.35.80.110 Association Id................................... 1 Authentication Algorithm......................... Open System Reason Code...................................... 1 Status Code...................................... 0 Session Timeout.................................. 0 Client CCX version............................... 5 Client E2E version............................... No E2E support Diagnostics Capability........................... Not Supported S69 Capability................................... Not Supported QoS Level........................................ Silver 802.1P Priority Tag.............................. disabled WMM Support...................................... Enabled Power Save....................................... OFF Current Rate..................................... 54.0 Supported Rates.................................. 1.0,2.0,5.5,11.0,6.0,9.0, ............................................. 12.0,18.0,24.0,36.0,48.0, ............................................. 54.0 Mobility State................................... Local Mobility Move Count.............................. 0 Security Policy Completed........................ Yes Policy Manager State............................. RUN Policy Manager Rule Created...................... Yes ACL Name......................................... none ACL Applied Status............................... Unavailable Policy Type...................................... WPA2 Authentication Key Management.................... PSK Encryption Cipher................................ CCMP (AES) Management Frame Protection...................... Yes EAP Type......................................... Unknown Interface........................................ management VLAN............................................. 80 Quarantine VLAN.................................. 0 Access VLAN...................................... 80
(WLC1) >show client detail 38:1c:1a:89:f4:c1 --> Switch in vlan 80 Client MAC Address............................... 38:1c:1a:89:f4:c1 Client Username ................................. N/A AP MAC Address................................... 00:22:bd:98:3a:30 AP Name.......................................... AP001 Client State..................................... Associated Client NAC OOB State............................. Access Workgroup Bridge Client.......................... WGB: 58:8d:09:03:e3:1c Wireless LAN Id.................................. 3 BSSID............................................ 00:22:bd:98:3a:32 Connected For ................................... 909 secs Channel.......................................... 1 IP Address....................................... 10.35.80.108 Association Id................................... 0 Authentication Algorithm......................... Open System Reason Code...................................... 1 Status Code...................................... 0 Session Timeout.................................. 0 Client CCX version............................... No CCX support QoS Level........................................ Silver 802.1P Priority Tag.............................. disabled WMM Support...................................... Disabled Power Save....................................... OFF Supported Rates.................................. Mobility State................................... Local Mobility Move Count.............................. 0 Security Policy Completed........................ Yes Policy Manager State............................. RUN Policy Manager Rule Created...................... Yes ACL Name......................................... none ACL Applied Status............................... Unavailable Policy Type...................................... WPA2 Authentication Key Management.................... N/A Encryption Cipher................................ None Management Frame Protection...................... No EAP Type......................................... Unknown Interface........................................ management VLAN............................................. 80 Quarantine VLAN.................................. 0 Access VLAN...................................... 0
(WLC1) >show client detail c4:34:6b:25:80:c8 --> Client in VLAN 81 Client MAC Address............................... c4:34:6b:25:80:c8 Client Username ................................. N/A AP MAC Address................................... 00:22:bd:98:3a:30 AP Name.......................................... AP001 Client State..................................... Associated Client NAC OOB State............................. Access Workgroup Bridge Client.......................... WGB: 58:8d:09:03:e3:1c Wireless LAN Id.................................. 3 BSSID............................................ 00:22:bd:98:3a:32 Connected For ................................... 919 secs Channel.......................................... 1 IP Address....................................... 10.35.81.32 Association Id................................... 0 Authentication Algorithm......................... Open System Reason Code...................................... 1 Status Code...................................... 0 Session Timeout.................................. 0 Client CCX version............................... No CCX support QoS Level........................................ Silver 802.1P Priority Tag.............................. disabled WMM Support...................................... Disabled Power Save....................................... OFF Supported Rates.................................. Mobility State................................... Local Mobility Move Count.............................. 0 Security Policy Completed........................ Yes Policy Manager State............................. RUN Policy Manager Rule Created...................... Yes ACL Name......................................... none ACL Applied Status............................... Unavailable Policy Type...................................... WPA2 Authentication Key Management.................... N/A Encryption Cipher................................ None Management Frame Protection...................... No EAP Type......................................... Unknown Interface........................................ coding VLAN............................................. 81 Quarantine VLAN.................................. 0 Access VLAN...................................... 81
***Configuring a specific Client VLAN
If wired devices connected to the WGBs Ethernet port should all be assigned to a specific VLAN then we can configure a VLAN for the connected devices. By using this command on the WGB:
WGB(config)# workgroup-bridge client-vlan vlan-id
All the devices connected to the Workgroup Bridge’s Ethernet port are assigned to that VLAN.
That’s all for today 🙂
