MSM760 Client data tunnel settings

[edwardv]

Hi,

When configuring a Guest access network which tunnels traffic from the access point to the controller and my Controlled Ap's - Client data tunnel is set to Less security better performance all is working fine. When I change the setting from Less Security Better performance to High Security Less Performance the client doesn't receive any ip address. The access point MSM320 and the controller MSM760 are in different ip subnets. On the VSC profile, the setting always tunnel client traffic is enabled, wireless security filters are disabled and the dhcp range is set.

Does somebody which setting I need to change to make it work with the higher security setting. Are possibly more information about this setting, the documentation on this is very limited:

For example the help file:

Less security/better performance: This option provides security using a secret key that is attached to each packet. The key is rotated every 200 seconds.

High security/less performance: This option uses HMAC (Hash based message authentication code) to ensure the data integrity and authenticity of each packet. Performance is reduced due to the overhead needed to calculate HMAC.

Regardless of the security method used, the client tunnel does not encrypt the data stream. To protect client traffic with encryption requires that client stations use WPA or VPN software.

Regards,

Edward Verweij

[JesseR]

Where in the MSM web interface are you seeing this High Security/Less Performance option?  I'm not familar with that.

[edwardv]

You can find the setting at controller level in the Gui / web interface: Controlled AP's - > Client Data Tunnel:

Secure the client data tunnel with:

Less Security / Better Performance or High Security / Less Performance

[edwardv · Accepted solution]

The problem is solved by running the latest software on the controller version 5.5.3.0

[pmartinez]

 Hi, I am trying to config a Guest access network which tunnels traffic from the access point to the controller. The dhcp server is the internet router, and the router is in the same VLAN that the VSC egress VLAN. The wireless client receives the IP but not ping the router or the controller. 

Please can you help me?