router VLAN and (aerohive) AP headaches

Hi,

Having here a RB2011iL, configured for some VLANs for different SSIDs.
I have acquired some aerohive AP230s, the easy way to config 'em is to let them have internet access to connect to https://extremecloudiq.com/
That works when I plug the AP into an “ordinary” router without VLAN setup.
Then I setup the AP via the web config to serve the SSIDs based on the VLANs.
Send the config to the APs.
Plug the AP into the RB2011iL, e.g. ether2.
The AP serves the SSIDs fine, have internet access over the APs WLAN, etc.
But of course the AP looses connection to extremecloudiq.
Plugged the AP back to the “ordinary” router, set it’s config Management and Native VLAN to 20.
Plugged the AP back to the RB2011iL.
The AP has still no connection to extremecloudiq. Gets no IP via DHCP.

What am I doing wrong?
routerb.rsc (4.61 KB)
Screenshot_2023-04-03_21-01-40.png

Have you checked to make sure that the VLANs configured for the APs are properly configured on the RB2011iL router?

It’s possible that the RB2011iL router is not properly tagging the VLAN traffic from the APs, which could be causing issues with the APs connecting to the cloud management platform.

You may want to try configuring the RB2011iL router to properly tag the VLAN traffic from the APs and ensure that the management VLAN is properly configured for the APs. Additionally, you may want to check the DHCP settings on the RB2011iL router to ensure that the APs are getting the proper IP addresses.

If these steps don’t work, it may be helpful to contact the support team for your RB2011iL router or Aerohive APs for further assistance with troubleshooting the issue.

Well, please see the attached rsc for the router config.

I think I have 2 options,
A make the AP use VLAN 20 as native and management IF. (VLAN 20 is definitely getting to the AP, the associated SSID works fine)
or
B make the RB2011iL route untagged AND tagged packets on ether2, add DHCP to untagged, what else?

Do not change native vlan from 1.

The AP sounds like it only need access to the internet for cloud management.
Thats fine, the AP should be on a trunk port from the router
Lets say you have three vlans on your MT

Trusted/Management VLAN-5
Guest WIFI - VLAN-10
IOT WIFI - VLAN-20

Lets say you also have a smart switch to another AP on ether2
Direct connection to AP on ether3
ether4 and ether 5 are to local pcs.

/interface bridge port
add bridge=bridge ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether2
add bridge=bridge ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether3
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-un-tagged interface=ether4 pvid=5
add bridge=bridge ingress-filtering=yes frame-types=admit-priority-and-un-tagged interface=ether5 pvid=5

/interface bridge vlan
add bridge=bridge tagged=bridge,ether2,ether3 untagged=ether4,ether5 vlan-ids=5
add bridge=bridge tagged=bridge,ether2,ether3 vlan-ids=10,20

Both smart switch and both APs, get IP address from vlan-5
Vlan5- is the management/trusted vlan.

Yeah thank you, actually should have NOT messed with the native VLAN setting.