2 questions about VLAN configuration.

[SerhMorh]

MC4200 controllers with 832i APs. SD 8.1-3-2

Question #1. In VLAN configuration help it says about IP address field 

"In the IP Address boxes, type the IP address. The IP address must match the IP address of the default gateway configured in wireless clients." 

is that correct? Does it have to be set as "default gateway" on a DHCP scope for that VLAN?  I always thought it was just a management interface of the controller on that VLAN.

Question #2. Setting up the same VLAN on multiple controllers (we have 3). Does each controller suppose to have a different IP address on the same VLAN? If so and Q1 is correct, how do you set up DHCP scope? Do you need a separate scope for each controller to define individual DG?

Thank you.

[markdr_FTNT · Accepted solution]

Hi Serhiy,

Q1. When you create a VLAN interface on the controller, the idea is that this is used when you want to tunnel all the traffic for that ESS/SSID back through the controller. For this to happen the gateway address has to reside on the controller. 

If you just want a management interface for a VLAN (but don't need to tunnel user traffic through it), then just add it in in the System settings | Management interfaces.

If you want the gateway address for a VLAN to reside on a device other than the controller then you can bridge the traffic locally and set the gateway to whatever you want it to be. In this case you don't need a VLAN interface on the controller. As long as the switches that connect to your AP's (and the controller up links) have the VLAN ID(s) tagged and the VLAN exists on the switch then you can statically assign the VLAN ID as part of the ESS profile and bridge the traffic straight onto the LAN.

Q.2 Can you elaborate on how your network has 3 controllers? (is it in a nplus1 / HA configuration or do they run their own set of AP's?)

Any given AP will only talk to one controller so whatever controller the AP talks to will need to have a VLAN interface address assigned if you want to tunnel the traffic. Generally speaking there is a DHCP scope configured for every VLAN, but it is not usually a separate scope for each controller unless you're running completely separate WLAN's from each controller.

Happy to assist further if you can elaborate on your configuration.

Regards,

Mark

[SerhMorh]

Hi Mark, 

Thank you for your reply. We have 3 MC4200 each running its own set of APs (one - high school, one -  middle schools and one for elementary schools). We also have a virtual controller in N+1 configuration.

Right now each controller has about 5 SSIDs that configured to tunnel traffic and 1 SSID in a bridge mode. Tunneled SSIDs and VLANS are the same on each controller (for example RPS_iPAd, RPS_Cell, RPS_Chrome etc) with a separate DHCP scope for each VLAN/SSID. So DHCP scope is the same for VLAN no matter which controller it is coming from and each client gets the same DG, IP address of the core switch on that VLAN and not the IP of the controller. We have been running this for years. 

Are you saying that because we do not configure clients DG with the IP address of the controller our traffic is not being tunneled? Then "Dataplane Mode" - "Tunneled" in ESS Profile setting makes no difference? And the controller is simply acting as any other network switch?

Thank you.