VLAN Bridging in Mobility Express using RAP and MAP
I won’t covert the initial ME configuration and the MAP joining to the controller (I supposed that you have the point to point up and running) as shown the image:
You can follow this link to convert the ME, and do the day zero config, this other link will help you for the point to point link creation.
- Computer 1 (Wired to SW1)
- Computer 2 (Wired to SW2)
- 2 Cisco Catalyst Switches (SW1 and SW2)
- 1542I ME WLC + RAP (Version 220.127.116.11)
- 1542I CAPWAP > MAP
I performed a factory reset in the APs prior starting this lab, from the Mobility Express AP initial configuration wizard, I set the internal AP to
flex+Bridge mode [yes] [NO]: yes
In case that you missed the flex+bridge setting, you can enable it running the following command in the RAP, you can also run the command in the MAP after the joining process.
RAP# capwap ap mode flex-bridge
A quick recap to get to the internal AP in your ME WLC connect a console cable to the physical device, and run;
(Cisco Controller) > apciscoshell
(It’s no possible to run that command via SSH or Telnet)
Switch ports where computers are connected are configured as access ports with VLAN 22:
SW1(config)#interface gigabitEthernet 0/2 SW1(config-if)#switchport mode access SW1(config-if)#switchport access vlan 22 SW1(config-if)#no shutdown SW1(config-if)#exit SW2(config)#interface gigabitEthernet 0/1 SW2(config-if)#switchport mode access SW2(config-if)#switchport access vlan 22 SW2(config-if)#no shutdown SW2(config-if)#exit
The Switch ports where APs are connected will be in trunk mode with the native VLAN set to 10:
SW1#configure terminal SW1(config)#interface gigabitEthernet 0/9 SW1(config-if)#switchport mode trunk SW1(config-if)#switchport trunk native vlan 10 SW1(config-if)#switchport trunk allowed vlan 10,22,33 SW1(config-if)#no shutdown SW1(config-if)#end SW2#configure terminal Enter configuration commands, one per line. End with CNTL/Z. SW2(config)#interface gigabitEthernet 0/0 SW2(config-if)#switchport mode trunk SW2(config-if)#switchport trunk native vlan 10 SW2(config-if)#switchport trunk allowed vlan 10,22,33 SW2(config-if)#no shutdown SW2(config-if)#end
Computer 1 IP ADDR 172.16.222.11/24 GW 172.16.222.254 Computer 2 IP ADDR 172.16.222.12/24 GW 172.16.222.25
ME WLC and AP IP Configuration
(Cisco Controller) >show interface summary Number of Interfaces.......................... 2 Interface Name Port Vlan Id IP Address Type Ap Mgr Guest -------------------------------- ---- -------- --------------- ------- ------ ----- management 1 untagged 172.16.10.10 Static Yes N/A virtual N/A N/A 192.0.2.1 Static No N/A
RAP#show ip interface brief Interface IP-Address Method Status Protocol Speed Duplex wired0 172.16.10.43 DHCP up up 1000 full auxiliary-client unassigned unset up up n/a n/a wifi0 n/a n/a up up n/a n/a wifi1 n/a n/a up up n/a n/a
MAP#show ip int brief Interface IP-Address Method Status Protocol Speed Duplex wired0 172.16.10.44 DHCP up up 100 full auxiliary-client unassigned unset up up n/a n/a wifi0 n/a n/a up up n/a n/a wifi1 n/a n/a up up n/a n/a
In order for wired clients behind the MAP send traffic over the mesh link, Ethernet Bridging needs to be enabled on the MAP under Wireless Settings > Access Points > MAP > Mesh:
Notice that we have the physical interface at the bottom of the page, if we click on edit, it will open the interface options:
Now, if we try to change the interface mode from Access to Trunk, adding the native VLAN, and the VLANs Id desire you will get an error:
We need to run one CLI commands to fix this, for now let’s continue changing another needed GUI setting.
The VLAN mode must be set as non-VLAN transparent (global mesh parameter). VLAN transparent is enabled by default, to set as non-VLAN transparent, you must unselect the VLAN transparent option in the Wireless > Mesh > Ethernet Bridging:
Let’s see the traffic flow making ICMP from Computer 2, let’s recall the Computer 2 belongs to VLAN 22.
ARP is working as expected, and the computer has bidirectional communication to its gateway
172.16.222.25 (SW2), but when computer pings the MAP IP address
172.16.10.44 the traffic is in one direction.
Let’s see another capture in the upstream device (which is the SW2) pointing to the MAP AP, the red arrow is our target interface:
So, we can see the ARP replied coming from the MAP, and the ICMP going out of the SW2, the destination the MAP IP, the traffic is getting tag on the VLAN 10 which tell us the SW2 is doing the job tagging traffic, but there is no replies getting back from MAP.
Converting from access to trunk the MAP physical port
As I said earlier, we need to run a CLI commands to make the VLAN mapping works, from the ME WLC run:
(Cisco Controller)> config flexconnect group default-flexgroup vlan enable
Let’s remember the ME by nature works in flexconnect, and globally we are enabling multiple VLANs support.
Now, if we go to the ME WLC GUI > Wireless Settings > Access Points > select the MAP and click edit > Mesh > Edit Interface we should be able to change the mode from Access to Trunk.
First step, change the Mode to trunk and add the Native VLAN ID, the native VLAN id must match with the native VLAN of your switch, hit apply.
Second step, add the VLAN ids needed, in my case 22 and 33, hit apply.
If you like the CLI way, you can go to the ME WLC CLI and run the following to accomplish the above;
(Cisco Controller) >config ap ethernet 0 mode trunk enable <AP Name> native-vlan <VLAN ID> (Cisco Controller) >config ap ethernet 0 mode trunk add <ap name> <vlan ID> >>>>> Up to 16 VLANs <<<<<<
Let’s see how this work!!!
From Computer 2, I will start the ICMP traffic again , but now I will ping the Computer 1 IP 172.16.222.11, the traffic should cross the wireless link:
In fact we can see the Computer 2 requesting ARP to know the physical location of Computer 1, and the ICMP traffic is bidirectional, now let’s see the tagging from the SW2 side:
Sweet, it’s the same traffic pattern, but now it includes the VLAN tagging (which is the expected scenario).
Lastly, I will run a round robin of ICMP from Computer 2, I will capture from SW2 to keep it simple and familiar:
SW1 has a SVI on VLAN 33 IP 172.16.33.254, now I can ping any device in VLAN 10, 22, and 33 from both ends.
The point to point VLAN mapping is working as expected!
I hope this post guide you and serve as your reference, I created this post because the documentation that I found is no very clear.