M and MSM Series
cancel
Showing results for 
Search instead for 
Did you mean: 

Where does a Guest VSC's IP gateway live?

 
Highlighted
ndoudna
Frequent Advisor

Where does a Guest VSC's IP gateway live?

I'm still trying to set up an HTML-authenticated guest VSC, access-controlled
in its own VLAN, with VSC DHCP relay (not DHCP server).

 

The problem is how to set up an IP gateway and VSC ingress on the same VLAN.
The controller won't allow a network profile (VLAN) to be assigned to both
"VSC ingress mapping" AND to an "IP interface".  It's one or the other.

 

Another thread suggests that for HTML-based authentication with splash pages
to work, the controller has to act as IP gateway for the Guest VSC:

http://h30499.www3.hp.com/t5/E-Series/MSM760-Staff-HTML-web-page-AD-authentication-on-iPad/m-p/5529535

 

So how can the Guest VSC run in its own VLAN and still use the controller
for the gateway?  Where does the VSC's IP gateway live?  (Not in the network
because then the wireless traffic bypasses the controller.)

 

thanks,
noemi

14 REPLIES 14
Highlighted
Fredrik Lönnman
Honored Contributor

Re: Where does a Guest VSC's IP gateway live?

The VSC IP gateway has to live in the controller, then you can put the Internet port in a separate VLAN and route through it.

---
CCIE Service Provider
MASE Network Infrastructure [2011]
H3CSE
CCNP R&S

Highlighted
ndoudna
Frequent Advisor

Re: Where does a Guest VSC's IP gateway live?

But how do you configure the Guest VSC's IP gateway in the Guest VSC VLAN if the VLAN is already assigned to the VSC ingress mapping?

 

For example:

 

Network Profile "Guest120" is defined, VLAN ID 120 (Controller > Network > Network profiles)

Network profile "Guest120" is mapped to the LAN port, tagged 120 (Controller > Network > VLANs)

 

Guest VSC subnet/VLAN:

   - IP subnet:  172.17.120.0/24

   - Gateway IP:  172.17.120.1

   - VSC ingress mapping: "Guest120 (120)"

 

Now how is IP interface 172.17.120.1 configured?  Controller > Network > IP interfaces won't allow it.

 

thanks,

noemi

Highlighted
ISoliman
Super Advisor

Re: Where does a Guest VSC's IP gateway live?

Are you configuring the DHCP option under the VSC ?? if yes then automatically when you put the gateway IP address the Controller will assign it to itself no need to do anything.

Highlighted
ndoudna
Frequent Advisor

Re: Where does a Guest VSC's IP gateway live?

No, I'd like to know how to set this up without the controller being the DHCP server.

 

I'm asking more of a design question, not a "how to" question. I'm not looking for a workaround; I want to  understand how every bit of it works so that if our customers ask how to do something, or if it can be done, that I have an answer.  "Just use the controller's DHCP server" isn't always going to fly.

 

 From a lot of experimenting, I've found a few facts that are necessary to support HTML-based authentication.  (Disclaimer: I still haven't succeeded in setting this up yet, due to other unrelated problems.)

 

- The LAN port must be the gateway for the Guest VSC's subnet.

 

- If the Controller is now to be used as the Gateway for a subnet, it needs another interface to send the traffic it's routing to.  Otherwise from a routing perspective it's a leaf.  So the Internet port has to be used also, with a default route in the controller pointing to the Internet port's next hop.

 

- Use the LAN port's "management" IP address to number the Controller, and have a DHCP scope somewhere in the network for that subnet for the APs' own management IP addresses.

 

- In the end, you end up with 3 subnets/VLANs:

 1 -- Internet port to the outside world gateway (Internet port)

 2 -- Controller/AP management (LAN mgmt IP address)

 3 -- Guest VSC / wireless clients (LAN port main IP address).

 

While you could use the Controller for DHCP, so far I've found nothing that indicates you have to, and some IT managers might not want to.  

 

HTML-based authentication shouldn't be hard, but it's quite a wiggle if you want a separate subnet, VLAN and DHCP scope for the guest VSC wireless clients, that does not include any IP address that belongs to the Controller itself.   Imagine that!

 

thanks,

noemi

Highlighted
ISoliman
Super Advisor

Re: Where does a Guest VSC's IP gateway live?

Check the Implementation Guide please it has the details about that and how to use the relay feature which is required if you are not using the DHCP server on the controller.

Highlighted
Fredrik Lönnman
Honored Contributor

Re: Where does a Guest VSC's IP gateway live?

Since the controller has to be the gateway and DNS for the client to use HTML based authentication there are some quirks that comes with it. Most of them are somewhat described in the Implementation Guide, but a few are not that obvious (like that the controller assigns the IP you specify in the VSC settings as dhcp-gateway or as source when you do dhcp-relay).

 

So the "- The LAN port must be the gateway for the Guest VSC's subnet." is not quite true, its the VSC itself (some internal dummy/virtual interface) that are the gateway, and you can have multiple guest VSCs in different subnets. 

---
CCIE Service Provider
MASE Network Infrastructure [2011]
H3CSE
CCNP R&S

Highlighted
ndoudna
Frequent Advisor

Re: Where does a Guest VSC's IP gateway live?

 

>>

So the "- The LAN port must be the gateway for the Guest VSC's subnet." is not quite true, its the VSC itself (some internal dummy/virtual interface

>>

 

That dummy/hidden interface is only assigned if the Controller is also used for DHCP server though, is that right?  What if you don't want to use the Controller for DHCP at ALL?

 

>>

...the controller assigns the IP you specify in the VSC settings as dhcp-gateway or as source when you do dhcp-relay

>>

 

DHCP relay: I've found that the VSC DHCP relay uses the Controller's LAN port IP address as the DHCP relay source -- unless you indicate another DHCP source IP address in "subnet selection" in the VSC.

 

(I've scoured the Implementation Guide many times; it's missing all sorts of crucial information, like that the Controller has to be gateway and DNS, and it also assumes you'll be using the Controller for DHCP.  It doesn't mention what "subnet selection" is for either.  Believe me, I wouldn't dream of posting these questions to you kind experts without the RTFM box checked off first :) )

 

thanks,

noemi

Highlighted
Fredrik Lönnman
Honored Contributor

Re: Where does a Guest VSC's IP gateway live?


@ndoudna wrote:

 

>>

So the "- The LAN port must be the gateway for the Guest VSC's subnet." is not quite true, its the VSC itself (some internal dummy/virtual interface

>>

 

That dummy/hidden interface is only assigned if the Controller is also used for DHCP server though, is that right?  What if you don't want to use the Controller for DHCP at ALL?

 

>>

...the controller assigns the IP you specify in the VSC settings as dhcp-gateway or as source when you do dhcp-relay

>>

 

DHCP relay: I've found that the VSC DHCP relay uses the Controller's LAN port IP address as the DHCP relay source -- unless you indicate another DHCP source IP address in "subnet selection" in the VSC.

 

(I've scoured the Implementation Guide many times; it's missing all sorts of crucial information, like that the Controller has to be gateway and DNS, and it also assumes you'll be using the Controller for DHCP.  It doesn't mention what "subnet selection" is for either.  Believe me, I wouldn't dream of posting these questions to you kind experts without the RTFM box checked off first :) )

 

thanks,

noemi


 

In a access-controller scenario the controllar has to be used as either DHCP server, or DHCP relay. In either way it HAS to be gateway (and DNS if you want HTML based access). Im totally with you that the Implementation guide is horrible for those things.. though it does actually mention the facts that the controller has to be gateway and DNS but its not really where you'd expect to find it, and even when you know it beforehand its not really obvious when you do read it ;\

---
CCIE Service Provider
MASE Network Infrastructure [2011]
H3CSE
CCNP R&S

Highlighted
ndoudna
Frequent Advisor

Re: Where does a Guest VSC's IP gateway live?

>it does actually mention the facts that the controller has to be gateway and DNS

 

Put me out of my misery, please -- WHERE?!

 

thanks,

noemi