Create the vlan 100 on the controller, but do not tag it on any controller port.
Check if the client is associated with correct ESSID and is in vlan 100. Use the following command on the mobility controller:
show ap remote debug association ap-name <your AP name>.
In VLAN 100 you need an IP helper because the DHCP server is in the main site.
------------------------------
Regards,
Waldemar
ACCX # 1377, ACEP, ACA - Network Security
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------
Original Message:
Sent: Feb 01, 2023 02:37 PM
From: cjoseph
Subject: Bridge Mode SSID AOS8
Type "show station-table" to see if the device is associated.
------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card
------------------------------
Original Message:
Sent: Feb 01, 2023 06:02 AM
From: danger
Subject: Bridge Mode SSID AOS8
Hi,
I have configured this as the following:
WP2-PSK
VAP profile: VLAN 100
VAP is in bridge mode.
Initial role on the controller is allow all.
VLAN 100 is not created on the controller just added in the VAP.
APs have VLAN 150 as untagged and VLAN 100 as tagged.
We tested this last week and it was working fine, today some sites where this is being used users are reporting they are unable to get a IP address. The DHCP server is located centrally at the main site. IP helper for VLAN 150 is on a firewall at each site.
Any ideas what this could be?
Original Message:
Sent: Jan 25, 2023 11:33 AM
From: lord
Subject: Bridge Mode SSID AOS8
What message do the users get? Can you post it?
In bridge mode WPA3 is not supported, is that what the message is about?
In the AAA profile nothing has to be modified for the bridged SSID.
The AP mgmt VLAN remains untagged, the user VLAN must be tagged.
------------------------------
Regards,
Waldemar
ACCX # 1377, ACEP, ACA - Network Security
If you find my answer useful, consider giving kudos and/or mark as solution
Original Message:
Sent: Jan 25, 2023 11:16 AM
From: danger
Subject: Bridge Mode SSID AOS8
Hi,
It is still not clear, this is what I have done:
The SSID in question is a PSK.
set VAP to bridge mode.
TAG client VLANs to the AP. Question: does AP MGMT VLAN need to be untagged and the client VLANS tagged?
When deploying the SSID in bridge mode rather than tunnel, why do users get a message that they are using weak security on their device. Is this expected?
Do we need to make any changes on the roles or the AAA profile for this bridged SSID?
Thanks,
Original Message:
Sent: Jan 25, 2023 08:32 AM
From: cjoseph
Subject: Bridge Mode SSID AOS8
Changing the forwarding mode lets the AP know when to bridge traffic.
------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card
Original Message:
Sent: Jan 25, 2023 05:28 AM
From: danger
Subject: Bridge Mode SSID AOS8
Is that all that is required? Do we need to do anything on the roles ?
How does the AP know where to send authentication traffic and when to bridge local traffic?
Original Message:
Sent: Jan 25, 2023 04:55 AM
From: lord
Subject: Bridge Mode SSID AOS8
In the "Forwarding mode" field, you must enter Bridge. The VLAN must be tagged on the switch port where the AP is connected.
------------------------------
Regards,
Waldemar
ACCX # 1377, ACEP, ACA - Network Security
If you find my answer useful, consider giving kudos and/or mark as solution