I have 3 vlans defined, a WAN1 port, and a trunk with all 3 vlans successfully passing across a trunk to a hAP AC, with DHCP for each vlan/subnet. I have wlan1 in the same bridge.
Now I want to enable three SSIDs, each on one of the 3 VLANs (3 additional vlans I could probably handle, but it’s a lot more config of filters, DHCP, etc).
My plan was to create three virtual WLAN interfaces for each VLAN. But it’s not working.
I can see the SSIDs, but am not getting an IP address from the DHCP server configured on the vlan.
Setting the interface to VLAN Mode: no tag and use tag doesn’t help (with the VLAN ID set to the vlan).
Setting the IP Address on the client (so skipping over DHCP) doesn’t help. I’m trying to use the non-CPU VLAN config on the CRS125, but I don’t see how that interacts with WLAN.
OK, I’m going to bet that my problem is related to the fact that the wlan1 interface isn’t in the Switch config for Vlan, Egress VLan Tag, and Ingres Vlan Trans.
I think the solution is to create 3 bridges w/ IPs for the virtual WLANs, 3 new VLANs for the virtual WLANs, and 3 new DHCP environments for the virtual WLANs.
Assign the DHCP servers to the 3 bridges.
Assign each vlan interface to the associated wlan virtual interface
Assign the associated vlan and wlan to each bridge
No, you most probably don’t need 3 bridges. But before explaining what needs to be done, post full config of your CRS … because correct config of L2 for wireless interfaces very much depend on actual config of L2 for ethernet interfaces. After all, the idea is to make wireless interfaces part of corresponding VLAN/ethernet networks.
Basically what you want to do is make your wireless interfaces VLAN tagged by setting vlan-id= vlan-mode=use-tag (you have them already) and then make them members of bridgeVLAN. Ditch the bridgeWLAN-* bridges. And use additional vlan interdaces for those extra VLANs … if you actually need them.
Note: in order to use switch chip to offload etgernet pirts you don’t have to have bridge exclusive for those ports. You can add other ports, traffic will still be offloaded for ports capable of doing it.
Can I have the wireless in the same vlan (in other words, guest lan and wlan in the same vlan) if I’m using the switch chip for the other ports? (I ask in part because that was NOT working)
I believe that’s the foundational part of my question, as many of the docs are for using the CPU, not the switch chip. I’m using the switch chip configuration for the non-wlan interfaces. So I don’t think that’s my problem (based on the support articles I started out with). If that’s wrong, if you could point out where so I can fix it!
Bridge VLAN-filtering was introduced with 6.41. Before that, VLAN tags had to be dealt with by hardware (e.g. switch chip) or device drivers (e.g. wireless driver with settings I mentioned in previous post). Bridge was very similar to “dumb switches”, passing VLAN tags without considering them and only using destination MAC addresses to determine egress port.
The same setup is still possible, also in 7.2 (I’m running ROS 7.2.1 on one of RB951G, featuring AR8327 switch chip which doesn’t offliad bridge vlan filtering).
With setup you posted in pist #4 above, intra-vlan inter-ethernet traffic is handled by switch chip and thus wirespeed without any impact on CPU load. Only use of multiple bridges to handle wireless traffic is convoluted and probably slightly heavier on CPU than would the simplified setup I proposed even if it was done correctly. And I hesitate to dig into the mess of configuration to see where it might be broken.
OK, well I:
-Moved all the wlan ports to the main bridge
-Removed the 3 WLAN bridges
-All of the virtual wlan interfaces were already use-tag, with the associated vlan.
-Moved all the ip addresses for the virtual wlan interfaces to their associated vlan.
-Added the WLAN vlans to the bridge
-I can’t move the DHCP Server interface(s) to the wireless vlans (error)
Before I did that, DHCP didn’t work, but static addresses on the wireless clients worked. Now wlan DHCP and static addresses appear to work. Will test more!
MKX what an odd way of phrasing that.
More directly a VLAN does not qualify as a bridge port. An etherport or WLAN port are considered bridge ports.
VLANs are what are tagged and untagged on /interface bridge vlans and for access ports, the access port needs to be identified with the associated PVID on the appropriate /interface bridge port line.
OK, between the two of you you lost me. I thought I had an understanding of how it should be, and got everything working based on what I thought were previous comments.
This configuration appears to work. Is there something in specific wrong with it? (and why?). Each port is assigned VLAN tags at the switch level which I thought was necessary to utilize the switch chip.
I thought I had an understanding of how it should be, and got everything working based on what I thought were previous comments.