Where does a Guest VSC's IP gateway live?

[ndoudna]

I'm still trying to set up an HTML-authenticated guest VSC, access-controlled
in its own VLAN, with VSC DHCP relay (not DHCP server).

The problem is how to set up an IP gateway and VSC ingress on the same VLAN.
The controller won't allow a network profile (VLAN) to be assigned to both
"VSC ingress mapping" AND to an "IP interface".  It's one or the other.

Another thread suggests that for HTML-based authentication with splash pages
to work, the controller has to act as IP gateway for the Guest VSC:

http://h30499.www3.hp.com/t5/E-Series/MSM760-Staff-HTML-web-page-AD-authentication-on-iPad/m-p/5529535

So how can the Guest VSC run in its own VLAN and still use the controller
for the gateway?  Where does the VSC's IP gateway live?  (Not in the network
because then the wireless traffic bypasses the controller.)

thanks,
noemi

[Fredrik Lönnman]

The VSC IP gateway has to live in the controller, then you can put the Internet port in a separate VLAN and route through it.

[ndoudna]

But how do you configure the Guest VSC's IP gateway in the Guest VSC VLAN if the VLAN is already assigned to the VSC ingress mapping?

For example:

Network Profile "Guest120" is defined, VLAN ID 120 (Controller > Network > Network profiles)

Network profile "Guest120" is mapped to the LAN port, tagged 120 (Controller > Network > VLANs)

Guest VSC subnet/VLAN:

   - IP subnet:  172.17.120.0/24

   - Gateway IP:  172.17.120.1

   - VSC ingress mapping: "Guest120 (120)"

Now how is IP interface 172.17.120.1 configured?  Controller > Network > IP interfaces won't allow it.

thanks,

noemi

[ISoliman]

Are you configuring the DHCP option under the VSC ?? if yes then automatically when you put the gateway IP address the Controller will assign it to itself no need to do anything.

[ndoudna]

No, I'd like to know how to set this up without the controller being the DHCP server.

I'm asking more of a design question, not a "how to" question. I'm not looking for a workaround; I want to  understand how every bit of it works so that if our customers ask how to do something, or if it can be done, that I have an answer.  "Just use the controller's DHCP server" isn't always going to fly.

 From a lot of experimenting, I've found a few facts that are necessary to support HTML-based authentication.  (Disclaimer: I still haven't succeeded in setting this up yet, due to other unrelated problems.)

- The LAN port must be the gateway for the Guest VSC's subnet.

- If the Controller is now to be used as the Gateway for a subnet, it needs another interface to send the traffic it's routing to.  Otherwise from a routing perspective it's a leaf.  So the Internet port has to be used also, with a default route in the controller pointing to the Internet port's next hop.

- Use the LAN port's "management" IP address to number the Controller, and have a DHCP scope somewhere in the network for that subnet for the APs' own management IP addresses.

- In the end, you end up with 3 subnets/VLANs:

 1 -- Internet port to the outside world gateway (Internet port)

 2 -- Controller/AP management (LAN mgmt IP address)

 3 -- Guest VSC / wireless clients (LAN port main IP address).

While you could use the Controller for DHCP, so far I've found nothing that indicates you have to, and some IT managers might not want to.  

HTML-based authentication shouldn't be hard, but it's quite a wiggle if you want a separate subnet, VLAN and DHCP scope for the guest VSC wireless clients, that does not include any IP address that belongs to the Controller itself.   Imagine that!

thanks,

noemi

[ISoliman]

Check the Implementation Guide please it has the details about that and how to use the relay feature which is required if you are not using the DHCP server on the controller.

[Fredrik Lönnman]

Since the controller has to be the gateway and DNS for the client to use HTML based authentication there are some quirks that comes with it. Most of them are somewhat described in the Implementation Guide, but a few are not that obvious (like that the controller assigns the IP you specify in the VSC settings as dhcp-gateway or as source when you do dhcp-relay).

So the "- The LAN port must be the gateway for the Guest VSC's subnet." is not quite true, its the VSC itself (some internal dummy/virtual interface) that are the gateway, and you can have multiple guest VSCs in different subnets. 

[ndoudna]

>>

So the "- The LAN port must be the gateway for the Guest VSC's subnet." is not quite true, its the VSC itself (some internal dummy/virtual interface

>>

That dummy/hidden interface is only assigned if the Controller is also used for DHCP server though, is that right?  What if you don't want to use the Controller for DHCP at ALL?

>>

...the controller assigns the IP you specify in the VSC settings as dhcp-gateway or as source when you do dhcp-relay

>>

DHCP relay: I've found that the VSC DHCP relay uses the Controller's LAN port IP address as the DHCP relay source -- unless you indicate another DHCP source IP address in "subnet selection" in the VSC.

(I've scoured the Implementation Guide many times; it's missing all sorts of crucial information, like that the Controller has to be gateway and DNS, and it also assumes you'll be using the Controller for DHCP.  It doesn't mention what "subnet selection" is for either.  Believe me, I wouldn't dream of posting these questions to you kind experts without the RTFM box checked off first :) )

thanks,

noemi

[Fredrik Lönnman]

---

@ndoudna wrote:

>>

So the "- The LAN port must be the gateway for the Guest VSC's subnet." is not quite true, its the VSC itself (some internal dummy/virtual interface

>>

That dummy/hidden interface is only assigned if the Controller is also used for DHCP server though, is that right?  What if you don't want to use the Controller for DHCP at ALL?

>>

...the controller assigns the IP you specify in the VSC settings as dhcp-gateway or as source when you do dhcp-relay

>>

DHCP relay: I've found that the VSC DHCP relay uses the Controller's LAN port IP address as the DHCP relay source -- unless you indicate another DHCP source IP address in "subnet selection" in the VSC.

(I've scoured the Implementation Guide many times; it's missing all sorts of crucial information, like that the Controller has to be gateway and DNS, and it also assumes you'll be using the Controller for DHCP.  It doesn't mention what "subnet selection" is for either.  Believe me, I wouldn't dream of posting these questions to you kind experts without the RTFM box checked off first :) )

thanks,

noemi

---

In a access-controller scenario the controllar has to be used as either DHCP server, or DHCP relay. In either way it HAS to be gateway (and DNS if you want HTML based access). Im totally with you that the Implementation guide is horrible for those things.. though it does actually mention the facts that the controller has to be gateway and DNS but its not really where you'd expect to find it, and even when you know it beforehand its not really obvious when you do read it ;\

[ndoudna]

>it does actually mention the facts that the controller has to be gateway and DNS

Put me out of my misery, please -- WHERE?!

thanks,

noemi