topic Msm765zl distributed forwarding in M and MSM Series

Msm765zl distributed forwarding

wirelessjohn — Sun, 25 Mar 2012 16:36:57 GMT

Has anyone got any information on how to set distributed forwarding up?? HP recomend setting this up but they dont seem to have much documentation on it.

Thanks

John

Re: Msm765zl distributed forwarding

Fredrik Lönnman — Sun, 25 Mar 2012 18:05:17 GMT

Never heard about it, what is it?

Re: Msm765zl distributed forwarding

wirelessjohn — Tue, 27 Mar 2012 18:58:51 GMT

Distributed forwarding allows you to off load the traffic from the access point directly to the switch that the access point is connected too, This saves the traffic being sent through the controller.

The only bit of information I have found deep inside one of the design guide says you have to create the same vlan that your wireless controller uses for the vsc on each switch with an access point and tag the access point in that vlan. This is all well and good on a fairly simple setup with all the routing between vlans taking place in one place and the rest of the network being layer 2.

But my design in bit more complicated and we route at the access layer/level so each switch is its own router and traffic it routed off to the server room or where ever it needs to go, this also means the wireless vlan only exists on the switch with the msm765zl in it and the access points tunnel all there traffic through it.

So I am looking for information on how to setup distributed forwarding up in this kind of setup and how I would make the same vlan appear on each router and how things like dhcp and ospf would handle it.

Thanks

Re: Msm765zl distributed forwarding

Fredrik Lönnman — Tue, 27 Mar 2012 19:19:30 GMT

Oh, right. Thats pretty much the default behavior of the MSM since tunneling everything through the controller is kinda a hack for guest users. Just create a VSC that is NOT access controlled and when you do the VSC binding you specify an egress VLAN for that VSC and you're done, the VSC will be localy bridged on the APs uplink port.

Re: Msm765zl distributed forwarding

wirelessjohn — Tue, 27 Mar 2012 20:03:06 GMT

Thanks for the reply

I must admit my knowledge is fast running out at this point but am I able to create the egress vlan on all routers and span it across the layer 3 network?? How would I IP each vlan and what default gateway would I have for the vlan??

Re: Msm765zl distributed forwarding

Fredrik Lönnman — Wed, 28 Mar 2012 03:58:22 GMT

No if you have a routed network you can't span a VLAN across it, you'll need to terminate the VLAN at every switch.

Re: Msm765zl distributed forwarding

wirelessjohn — Wed, 28 Mar 2012 08:18:54 GMT

I didn't think you could span the vlan. So how would I go about making vlan 100 appear on each switch?? I take it vlan 100 on each switch need a different default gateway?? but within the IP address range that vlan 100 uses??

Re: Msm765zl distributed forwarding

ndoudna — Fri, 30 Mar 2012 17:00:53 GMT

Cobbling together from HP's manuals and training "distributed forwarding" means that authentication and wireless user traffic does not go through the controller. The way to implement this is in the VSC configuration: Authentication UNCHECKED and Access controlled UNCHECKED. (haven't tried this on a 765zl, but it seems to be the case on my MSM710.)

p5-6 of the "HP MSM7xx Controllers Management and Configuration Guide" shows this pretty well, with pictures, even. A text summary:

Centralized access control:

- Management, authentication and wireless user traffic all go through the controller.

- VSC: Authentication CHECK. Access control: CHECK

- (seems to be necessary for HTML-based authentication)

Distributed forwarding with centralized authentication:

- Management and authentication traffic go to the controller.

- Wireless user traffic bypasses the controller.

- VSC: Authentication CHECK. Access control: UNCHECK

Distributed forwarding:

- Authentication and wireless user traffic bypass the controller.

- Management traffic goes to the controller.

- VSC: Authentication UNCHECK Access control: UNCHECK

thanks,

noemi

Re: Msm765zl distributed forwarding

ndoudna — Fri, 30 Mar 2012 17:26:26 GMT

>>
So I am looking for information on how to setup distributed forwarding up in this kind of setup and how I would make the same vlan appear on each router and how things like dhcp and ospf would handle it.

Are your APs all on different switches? In any case, even if they are, if you have a VSC that is using an egress VLAN ID of 100, then:

- Every port that an AP is attached to needs to be tagged for 100.

- Any trunk that interconnects the switches needs to be tagged for 100.

- One of the switches needs to have an ip address associated with its vlan 100

- That ip address would be the gateway (e.g. 10.10.100.1) for that VSC/subnet/VLAN of 100.

- That ip interface would need an ip helper-address to convert DHCP discovery broadcasts to unicast, with the helper-address pointing to a DHCP server that has a scope for your VSC/VLAN/subnet (e.g. 10.10.100.11-249).

- The switch that has the ip gateway interface on VLAN 100 will also have other IP interfaces and routing to reach the rest of the layer 3 network, especially the DHCP and DNS servers.

I find IP interfaces on L2 switches incredibly confusing. This "wired" part of wireless installations takes way more time than the wireless itself!

don't know if this answers the question, but it's one I've had a lot!

thanks,
noemi