Dual SSID Wi-Fi issue

B

BigD1108

Limp Gawd
Joined
Nov 6, 2008
Messages
165
So, here's the scenario:

We have a client that is a non-profit organization, and they wanted a public/private Wi-Fi set up in their building. They have an ASA5505 firewall (base license, no Security Plus) so I researched a way they could do it without paying the astronomical Cisco licensing fees. What I came up with was this:

Put a layer 2 managed switch (enter the Netgear GS108v2) in between the AP (an EnGenius EAP9550) and the ASA to handle the VLANs, and route the traffic over two separate cables in lieu of the inter-VLAN routing capabilities of a Security Plus-equipped ASA. The setup is as follows:

AP goes to Port 1 on GS108 - this port is a VLAN trunk with memberships on VLAN1 (data VLAN) and VLAN20 (Guest Wifi VLAN)

Port 2 on GS108 (Member of VLAN1 only) goes to Ethernet0/2 on ASA (also member of VLAN1)

Port 3 on GS108 (Member of VLAN20 only) goes to Ethernet0/3 on ASA (member of VLAN20)

Below is a crude diagram of the topology, as well as screenshots from the relevant configuration of the GS108, the AP, and the running config of the ASA (sanitized to protect the innocent, of course).

Crappy diagram:
JGIb8.png


VLAN1 port membership (T denotes tagged, U denotes untagged, blank means port is not a member of given VLAN)
C6n97.png


VLAN20 port membership:
Db8f6.png


PVID:
Qy8J5.png


AP VLAN configuration:
fb3Xq.png


Code: 
ASA Version 7.2(3)
!
hostname ASA
domain-name xxx.local
enable password HHJ828BJvIPyXFCxxlN encrypted
names
name 192.168.1.151 camera
name 192.168.1.150 sensor
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address xx.xx.xx.xx 255.255.255.252
!
interface Vlan20
 no forward interface Vlan1
 nameif GUEST
 security-level 50
 ip address 192.168.20.1 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
 switchport access vlan 20
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd HdcHJ88BJvIPyXFClN encrypted
ftp mode passive
dns server-group DefaultDNS
 domain-name xxx.local
access-list inbound extended permit tcp any any eq https
access-list inbound extended permit tcp any any eq 3389
access-list inbound extended permit tcp any any eq 39001
access-list inbound extended permit tcp any any eq www
access-list inbound extended permit tcp any interface outside eq 39001
access-list inbound extended permit tcp host xx.xx.xxx.x any eq smtp
access-list inbound extended permit tcp any any eq 9999
access-list inbound extended permit tcp host xx.xx.xx.x any eq ldap
access-list inbound extended permit tcp host xx.xxx.xx.xx any eq ldap
access-list inbound extended permit tcp host xx.xx.xx.xx any eq smtp
access-list vpn-acl extended permit ip 192.168.100.0 255.255.255.0 192.168.1.0 2
55.255.255.0
access-list vpn-acl extended permit ip 192.168.1.0 255.255.255.0 192.168.100.0 2
55.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu GUEST 1500
ip local pool clientpool 192.168.100.1-192.168.100.10 mask 255.255.255.0
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list vpn-acl
nat (inside) 1 0.0.0.0 0.0.0.0
nat (GUEST) 1 192.168.20.0 255.255.255.0
static (inside,outside) tcp interface 10001 sensor 38001 netmask 255.255.255.255

static (inside,outside) tcp interface 39001 camera www netmask 255.255.255.255
static (inside,outside) tcp interface smtp 192.168.1.2 smtp netmask 255.255.255.
255
static (inside,outside) tcp interface https 192.168.1.2 https netmask 255.255.25
5.255
static (inside,outside) tcp interface 3389 192.168.1.2 3389 netmask 255.255.255.
255
static (inside,outside) tcp interface 9999 sensor 9999 netmask 255.255.255.255
static (inside,outside) tcp interface ldap 192.168.1.2 ldap netmask 255.255.255.
255
access-group inbound in interface outside
route outside 0.0.0.0 0.0.0.0 xxx.xx.xxx.xxx 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa-server vpn protocol radius
aaa-server vpn host 192.168.1.2
 key cisco111
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server community public
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set myset esp-3des esp-md5-hmac
crypto dynamic-map cisco 1 set transform-set myset
crypto map dyn-map 20 ipsec-isakmp dynamic cisco
crypto map dyn-map interface outside
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400
crypto isakmp nat-traversal  20
telnet 192.168.1.0 255.255.255.255 inside
telnet 192.168.1.0 255.255.255.0 inside
telnet timeout 5
ssh xx.xxx.xx.xx 255.255.255.255 outside
ssh xx.xx.xx.x 255.255.255.255 outside
ssh timeout 60
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.20.2-192.168.20.33 GUEST
dhcpd dns 8.8.8.8 4.2.2.2 interface GUEST
dhcpd enable GUEST
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
group-policy xxxvpn internal
group-policy xxxvpn attributes
 wins-server value 192.168.1.2
 dns-server value 192.168.1.2
 vpn-idle-timeout 30
 vpn-tunnel-protocol IPSec l2tp-ipsec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value vpn-acl
 default-domain value xxx.local
 split-dns value xxx.local
 nem enable
tunnel-group xxxvpn type ipsec-ra
tunnel-group xxxvpn general-attributes
 address-pool clientpool
 authentication-server-group vpn
 default-group-policy xxxvpn
tunnel-group DCMMvpn ipsec-attributes
 pre-shared-key *
prompt hostname context
Cryptochecksum:27291af3b365e0df706053964072ba0a
: end

The problem: Private(VLAN1) WLAN seems to function normally. The public side of the WLAN does not function at all. It will not pull a DHCP address, and there is no connectivity to VLAN20 from what I can tell (i.e. using built-in diagnostics from AP and switch, I cannot ping 192.168.20.1, the address of the VLAN20 interface on the ASA). My feeling is that there is something wrong with the switch configuration, but I can't figure out what it is, and it is frustrating the hell out of me.

I would be most appreciative if someone could show me the error of my ways on this one. In the future, I will be telling the client to STFU and buy the proper licensing, but it's a little late for that now. :)

Thanks in advance.
 
I could help you with Cisco but those GS108 switches are POS. I cant figure out this simple rediculous dumb ass switch that is on my desk. So I replaced it with a Cisco 2960.
 
Yeah, with a Cisco switch this would have been a piece of cake. Unfortunately, if the client could afford to buy a Cisco switch, they could also afford to buy an ASA Security Plus license, negating the need for the switch all together. :)

In any case, $5 PayPal reward to the person who helps me resolve this.
 
We had a Netgear switch that was dodgy.

Stop tagging on the AP AND the switch, just tag on the switch.

I.e. remove all VLAN settings from the AP and tag at the switch

This makes sense to me as vlan 1 is default vlan in Netgear terms so it thinks its effectively untagged (at least the firmware we used thought vlan 1 meant untagged).
 
I'm gonna head onsite here in a little bit and give that a shot, thanks for the response.
 
BigD1108 said:
I'm gonna head onsite here in a little bit and give that a shot, thanks for the response.
Click to expand...

I can almost guarantee that will work, this is exactly the issue we had with the same switch.

It double tags and then the router just drops the frame
 
GS108's are unreliable and generally suck. GS108E is what you want, the code is newer, (less buggy) and it has almost 100 times the MTBF (seriously!)

The GS108T is even newer and more capable, but the MTBF is 1/3rd that of the GS108E.....and still way more reliable than the GS108.

Change VLAN 20 port 3 to Tagged and try again.

If that does not work take out all the extra stuff for VLAN 20 on the ASA. Verify that you can pass traffic from the internet to VLAN 20 first. Then lock it (the VLAN) down.
 
That's a really old version of ASA on there. Not that it would fix your problem (most likely wouldn't), it's just really old.
 
Update: Removing VLAN settings from AP did not do the trick. Neither did changing VLAN20 on the switch from untagged to tagged.

The ASA config appears to be sound - if I plug a cable from Ethernet0/3 to my laptop, I am able to get a DHCP address and get out to the Internet.

Definitely regretting buying this switch.

/usr/home, noticed the oldness of the ASA version, one problem at a time. :)
 
Update #2: For testing, I assigned Port 4 on the switch to VLAN20 and PVID 20, and it works flawlessly.....it appears that either the trunking on the GS108Tv2 is messed up, or something on the AP is wonky.

When I try to ping to 192.168.20.1 from the AP's diagnostic page, I always get a "network is unreachable" message.
 
BigD1108 said:
Update #2: For testing, I assigned Port 4 on the switch to VLAN20 and PVID 20, and it works flawlessly.....it appears that either the trunking on the GS108Tv2 is messed up, or something on the AP is wonky.

When I try to ping to 192.168.20.1 from the AP's diagnostic page, I always get a "network is unreachable" message.
Click to expand...

You only tagging at the switch now, or at both?
 
Was just tagging it at the switch, with no luck.

However, it appears that the AP hardware may be bad. During the course of my troubleshooting, the AP would randomly stop broadcasting the SSIDs, and when I was able to connect to the "Private" SSID, it would drop packets when pinging from my laptop to 192.168.1.1

Plugging the AP's patch cable directly into my laptop and pinging to 192.168.1.1 yielded no dropped packets, so I dropped a spare AP in there and am in the process of RMA'ing the bad one.

Thank you for all the helpful comments though, may have a few more questions when the (hopefully) good AP shows back up. :)
 
You must log in or register to reply here.
Back
Top