Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have 2 SSID setup in my Cisco 881W router. Our internal ssid pulls from the right DHCP pool (wpool), while our guest SSID does not pull from the right pool (gpool)

Here is the router config

!
! Last configuration change at 08:13:57 PCTime Tue Aug 10 2010 by admin
!
version 15.0
no service pad
service tcp-keepalives-in
service tcp-keepalives-out
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service sequence-numbers
!
hostname router
!
boot-start-marker
boot-end-marker
!
security authentication failure rate 3 log
security passwords min-length 6
logging buffered 51200
logging console critical
enable secret 5 #pass#
!
no aaa new-model
memory-size iomem 10
clock timezone PCTime -5
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
!
crypto pki trustpoint TP-self-signed-1169761916
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1169761916
 revocation-check none
 rsakeypair TP-self-signed-1169761916
!
!
crypto pki certificate chain TP-self-signed-1169761916
 certificate self-signed 01 nvram:IOS-Self-Sig#1.cer
no ip source-route
!
!
ip dhcp excluded-address 10.0.0.1
ip dhcp excluded-address 10.100.0.1 10.100.10.0
ip dhcp excluded-address 10.100.10.255 10.100.255.254
!
ip dhcp pool ccp-pool1
   import all
   network 10.10.10.0 255.255.255.0
   dns-server #DNS# 
   default-router 10.10.10.1 
!
ip dhcp pool gpool
   import all
   network 10.100.10.0 255.255.255.0
   dns-server #DNS#
   default-router 10.100.10.1 
!
ip dhcp pool wpool
   import all
   network 10.10.100.0 255.255.255.0
   dns-server #DNS#
   default-router 10.10.100.1 
!
!
ip cef
no ip bootp server
ip domain name #redact#
ip name-server #redact#
ip name-server #redact#
no ipv6 cef
!
!
license udi pid CISCO881W-GN-A-K9 sn #REDACT#
!
!
username admin privilege 15 secret 5 #REDACT#
!
!
ip tcp synwait-time 10
ip ssh time-out 60
ip ssh authentication-retries 2
!
class-map type inspect match-any ccp-cls-insp-traffic
 match protocol cuseeme
 match protocol dns
 match protocol ftp
 match protocol h323
 match protocol https
 match protocol icmp
 match protocol imap
 match protocol pop3
 match protocol netshow
 match protocol shell
 match protocol realmedia
 match protocol rtsp
 match protocol smtp
 match protocol sql-net
 match protocol streamworks
 match protocol tftp
 match protocol vdolive
 match protocol tcp
 match protocol udp
class-map type inspect match-all ccp-insp-traffic
 match class-map ccp-cls-insp-traffic
class-map type inspect match-any ccp-cls-icmp-access
 match protocol icmp
 match protocol tcp
 match protocol udp
class-map type inspect match-all ccp-invalid-src
 match access-group 100
class-map type inspect match-all ccp-icmp-access
 match class-map ccp-cls-icmp-access
class-map type inspect match-all ccp-protocol-http
 match protocol http
!
!
policy-map type inspect ccp-permit-icmpreply
 class type inspect ccp-icmp-access
  inspect 
 class class-default
  pass
policy-map type inspect ccp-inspect
 class type inspect ccp-invalid-src
  drop log
 class type inspect ccp-protocol-http
  inspect 
 class type inspect ccp-insp-traffic
  inspect 
 class class-default
  drop
policy-map type inspect ccp-permit
 class class-default
  drop
!
zone security out-zone
zone security in-zone
zone-pair security ccp-zp-self-out source self destination out-zone
 service-policy type inspect ccp-permit-icmpreply
zone-pair security ccp-zp-in-out source in-zone destination out-zone
 service-policy type inspect ccp-inspect
zone-pair security ccp-zp-out-self source out-zone destination self
 service-policy type inspect ccp-permit
! 
!
!
!
!
!
!
interface FastEthernet0
 switchport access vlan 2
!
interface FastEthernet1
 switchport access vlan 2
!
interface FastEthernet2
 switchport access vlan 2
!         
interface FastEthernet3
 switchport access vlan 2
!
interface FastEthernet4
 description $ES_WAN$$FW_OUTSIDE$$ETH-WAN$
 ip address #REDACT#
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 zone-member security out-zone
 duplex auto
 speed auto
!
interface wlan-ap0
 description Service module interface to manage the embedded AP
 ip unnumbered Vlan1
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 arp timeout 0
!
interface Wlan-GigabitEthernet0
 description Internal switch interface connecting to the embedded AP
 switchport mode trunk
!
interface Vlan1
 description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$ES_LAN$$FW_INSIDE$
 ip address 10.10.10.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
 ip tcp adjust-mss 1452
!
interface Vlan2
 ip address 10.10.100.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
!
interface Vlan3
 ip address 10.100.10.1 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip flow ingress
 ip nat inside
 ip virtual-reassembly
 zone-member security in-zone
!
ip forward-protocol nd
ip http server
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source list 2 interface FastEthernet4 overload
ip nat inside source list 3 interface FastEthernet4 overload
ip nat inside source list 4 interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 #REDACT#
!
logging trap debugging
access-list 1 remark INSIDE_IF=Vlan1
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 10.10.10.0 0.0.0.255
access-list 2 remark CCP_ACL Category=2
access-list 2 permit 10.10.10.0 0.0.0.255
access-list 3 remark CCP_ACL Category=2
access-list 3 permit 10.10.100.0 0.0.0.255
access-list 4 remark CCP_ACL Category=2
access-list 4 permit 10.100.10.0 0.0.0.255
access-list 101 deny   ip 10.10.10.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 101 deny   ip 10.100.10.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 101 deny   icmp 10.10.10.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 101 deny   icmp 10.100.10.0 0.0.0.255 10.10.100.0 0.0.0.255
access-list 102 permit ip host 255.255.255.255 any
no cdp run

!
!
!
!
!
control-plane
!
banner exec ^C
Welcome to the jungle.

^C
banner login ^CIf a router goes down and no one is around to browse the internet, did it drop any packets
^C
!
line con 0
 login local
 no modem enable
 transport output telnet
line aux 0
 login local
 transport output telnet
line 2
 no activation-character
 no exec
 transport preferred none
 transport input all
line vty 0 4
 privilege level 15
 login local
 transport input telnet ssh
!
scheduler max-task-time 5000
scheduler allocate 4000 1000
scheduler interval 500
end

and here is the AP config

!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ap
!
enable secret 5 #REDACT#
!
no aaa new-model
!
!
dot11 mbssid
dot11 syslog
!
dot11 ssid Guest
   vlan 3
   authentication open 
   authentication key-management wpa version 2
   mbssid guest-mode
   wpa-psk ascii 0 secret1
!         
dot11 ssid internal
   vlan 2 
   authentication open 
   authentication key-management wpa version 2
   mbssid guest-mode
   wpa-psk ascii 0 secret2
!         
!         
!         
username admin privilege 15 secret 5 #REDACT#
!         
!         
bridge irb
!         
!         
interface Dot11Radio0
 no ip address
 no ip route-cache
 !        
 encryption mode ciphers tkip 
 !        
 encryption vlan 2 mode ciphers aes-ccm tkip 
 !        
 encryption vlan 3 mode ciphers aes-ccm tkip 
 !        
 broadcast-key vlan 2 change 30
 !        
 !        
 ssid Guest
 !        
 ssid internal
 !        
 antenna gain 0
 station-role root access-point
!         
interface Dot11Radio0.2
 encapsulation dot1Q 2
 no ip route-cache
 bridge-group 2
 bridge-group 2 block-unknown-source
 no bridge-group 2 source-learning
 no bridge-group 2 unicast-flooding
 bridge-group 2 spanning-disabled
!         
interface Dot11Radio0.3
 encapsulation dot1Q 3 native
 no ip route-cache
 bridge-group 3
 bridge-group 3 subscriber-loop-control
 bridge-group 3 block-unknown-source
 no bridge-group 3 source-learning
 no bridge-group 3 unicast-flooding
 bridge-group 3 spanning-disabled
!         
interface GigabitEthernet0
 description the embedded AP GigabitEthernet 0 is an internal interface connecting AP with the host router
 no ip address
 no ip route-cache
!         
interface GigabitEthernet0.2
 encapsulation dot1Q 2
 no ip route-cache
 bridge-group 2
 no bridge-group 2 source-learning
 bridge-group 2 spanning-disabled
!         
interface GigabitEthernet0.3
 encapsulation dot1Q 3 native
 no ip route-cache
 bridge-group 3
 no bridge-group 3 source-learning
 bridge-group 3 spanning-disabled
!         
interface BVI1
 mtu 1514 
 ip address 10.10.10.2 255.255.255.0
 no ip route-cache
!         
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
!         
!         
!         
line con 0
 privilege level 15
 login local
 no activation-character
line vty 0 4
 login local
!         
cns dhcp  
end

I'm not sure where the issue lies.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

It looks like you have your AP using vlan ID 3 as its native vlan (untagged), while your router is using the default vlan 1 as its native vlan. Create a vlan 1 on your AP as the native vlan and this should correct this behavior.

share|improve this answer
    
So would I add a .1 interface for both the gig and dot11 trunks? or could i just remove native from vlan 3? –  Dan McClain Aug 11 '10 at 18:46
    
You should be able to just remove 'native' from vlan 3. –  Peter Aug 11 '10 at 20:43
    
@Peter: I removed the native from both encapsulation dot1Q 3 lines in the dot11 0.3 and gig 0.3, now that SSID doesn't hand out ANY dhcp addresses –  Dan McClain Aug 12 '10 at 11:45
    
I was afraid of that. There are two possible solution that I can think of: * Put the "native" tags back on the AP interfaces and on the router interface that connects to the AP (interface Wlan-GigabitEthernet0) set "switchport trunk native vlan 3" * create a vlan 1 interface on the AP and set it as "native" interface GigabitEthernet0.1 encapsulation dot1Q 1 native no ip route-cache bridge-group 1 no bridge-group 1 source-learning bridge-group 1 spanning-disabled (Sorry this is mangled, comments don't allow formatting.) –  Peter Aug 12 '10 at 14:17
    
After trying to add vlan 3 as the native vlan on the router for wlan-gig 0, it warned that vlan3 does not exist...which is strange because it is in the running and startup config. I am going to try giving the vlan a new number –  Dan McClain Aug 13 '10 at 12:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.