Last week one of my friend called me there have a serious problem with their Network, none can print in their Network Printer, only few people can access the internet. Since it’s a Small Business Organization with less than 100 people working they had a pretty simple Network Setup mainly for internet, email and printing. They are using most of the Linksys’s Access Points for their Wireless Network. But often people fail to consider the following while installing multiple Access Point in their offices.

1)      Most of the people fail to disable the DHCP services in the access points which lead to multiple gateways in a small network which leads to problem in accessing the internet and other services they are using.

2)       One more common mistake I noticed is they configure SSID in the same channel which leads to channel over lapping.

3)      Forget to disable DHCP services in their Internet gateway even though they have a dedicated DHCP server.

Today morning I was late to arrive at my office due to some problems, when I came I saw my colleagues were trying hard to figure out the rouge DHCP server detected in our helpdesk VLAN. All our users in the help desk and call center were getting an IP address from the Rouge DHCP server and they were not able to access our Network. I tried to figure out the physical location of the rouge DHCP server but I failed to find.

Immediately I thought let me figure out the Mac address of the rouge DHCP server so that I can block its network access.

I went one of the affected systems and from the command prompt; I used the “arp –a followed by the rouge DHCP server as show below

C:\>arp -a 192.168.142.2

Interface: 192.168.142.96 — 0xb

  Internet Address      Physical Address      Type

  192.168.142.2           00-16-35-c1-7f-cc     dynamic

Once I got the Mac address, immediately I logged into a Cisco 3560 Switch connected in that area. From the privilege mode I used “show mac-address table” command to figure out the interface in which the rouge DHCP is connected.

RRBM-ITD-3560-AS01#sho mac address-table

          Mac Address Table

——————————————-

Vlan    Mac Address       Type        Ports

—-    ———–       ——–    —–

 All    0100.0ccc.cccc    STATIC      CPU

 All    0100.0ccc.cccd    STATIC      CPU

All    ffff.ffff.ffff    STATIC      CPU

 129    0000.0c07.ac3a    DYNAMIC     Gi0/52

 129    0002.e356.9cfa    DYNAMIC     Gi0/52

 129    0002.e356.a78f    DYNAMIC     Gi0/39

 129    000e.7fd8.6cff    DYNAMIC     Gi0/7

 129    000f.fe0a.1ff7    DYNAMIC     Gi0/22

 129    0016.35c1.7fcc  DYNAMIC     Gi0/36

 129    000f.fe6f.5d5c    DYNAMIC     Gi0/52

 129    000f.fe6f.5e46    DYNAMIC     Gi0/52

 129    000f.fe93.d890    DYNAMIC     Gi0/8

 129    000f.fe93.fcb0    DYNAMIC     Gi0/7

 129    000f.fe93.fcb8    DYNAMIC     Gi0/52

 129    000f.fe96.0920    DYNAMIC     Gi0/38

 129    000f.fe96.5478    DYNAMIC     Gi0/52

RRBM-ITD-3560-AS01#

Once I detected the interface to which the rouge DHCP sever connected, I disabled the interface in the Cisco 3560 Switch.

RRBM-ITD-3560-AS01# configure t

Enter configuration commands, one per line.  End with CNTL/Z.

RRBM-ITD-3560-AS01(config)#interface gigabitEthernet 0/36

RRBM-ITD-3560-AS01(config-if)#shutdown

RRBM-ITD-3560-AS01(config-if)#description ROUGE DHCP

RRBM-ITD-3560-AS01(config-if)#exit

RRBM-ITD-3560-AS01#

To prevent this from happening I configured the DHCP snooping in the Cisco 3560 Switch.

After careful inspection we figured out the rouge DHCP sever was running in a Virtual Machine, one of our aspiring professional was testing Active directory and DHCP services in a Virtual Windows 2003 Server.

Whenever you come across this kind of situation doesn’t panic just try to troubleshoot the problem in a systematic way. Just by following few simple steps you can eliminate this problem.

The keys steps

Step 1 – Figure out the MAC address using the “arp –a” followed by ip address of the rouge DHCP server from the affected PC.

Step 2- Log into your Switch and figure out the interface to which the rouge DHCP server is connected “Show mac-address table” (Cisco IOS Switches).

Step 3- Disable the interface connected to the rouge DHCP server in your Switch “shutdown” (Cisco IOS Switches).

Step 4 – Take precaution by configuring DHCP snooping in your Network.

In today’s entry we will focus on configuration of VLANs and SSIDs in a Cisco Aironet 1250 Series Access Point. The procedure is as follows.

Configure

In this section, you will see the configuration steps required to complete the above mentioned scenario.

1^st Step: Configure the Native VLAN on the Cisco Aironet 1250 Series Access Point

The Native VLAN is a VLAN to which the Cisco Aironet 1250 Series Access Point and the Cisco Catalyst 3560 Switch are connected. Native VLAN of the Cisco Aironet 1250 Series Access Point is usually different from the other VLANS configured in the Cisco Aironet 1250 Series Access Point (In our case VLAN 101 and VLAN 102). The IP address used for the management of the Cisco Aironet 1250 Series Access Point is assigned to its BVI Interface and the IP address assigned is in the native VLAN. (In our case VLAN 100). . The traffic, for example, management traffic, sent to and by the Point itself assumes the native VLAN (VLAN 100), and it is untagged. All untagged traffic that is received on an IEEE 802.1Q (dot1q) trunk port is forwarded with the native VLAN (VLAN 100) that is configured for the port. If a packet has a VLAN ID that is the same as the native VLAN ID of the sending port, the Cisco Catalyst 3560 Switch sends the packet without a tag. Otherwise, the switch sends the packet with a tag.

In order to configure a native VLAN on a Cisco Aironet 1250 Series Access Point, issue the following commands in the global configuration mode on the Cisco Aironet 1250 Series Access Point

ITKE-AP-01(config)#interface gigabitEthernet 0.100

ITKE-AP-01(config-subif)# encapsulation dot1Q 100 native

ITKE-AP-01(config-subif)#exit

(The above commands will configure the encapsulation as dot1q and assign VLAN 100 as the native VLAN on the Giga Ethernet interface.)

ITKE-AP-01(config)#interface dot11radio 0.100

ITKE-AP-01(config-subif)# encapsulation dot1Q 100 native

ITKE-AP-01(config-subif)#exit

(The above commands will configure the encapsulation as dot1q and assign VLAN 100 as the native VLAN on the radio interface.)

2^nd Step: Configure the SSIDs on the Cisco Aironet 1250 Series Access Point

In this step we will configure two VLANs (VLAN 101 & VLAN 102) one for the ITKE administration department and other for the guest users only with an internet access.  The SSIDs are also need to be associated with specific VLANS as shown below.

·         VLAN 101 for the ITKE administration department and uses the SSID ADMIN.

·         VLAN 102 for the guest users and uses the SSID GUEST.

In order to configure a VLAN101 and 102 on a Cisco Aironet 1250 Series Access Point, issue the following commands in the global configuration mode on the Cisco Aironet 1250 Series Access Point

ITKE-AP-01(config)#dot11 ssid ADMIN

ITKE-AP-01(config-ssid)#authentication open

ITKE-AP-01(config-ssid)#vlan 101

 (The above commands will create an ssid ADMIN, assigned to VLAN 101 and with an open authentication.)

ITKE-AP-01(config)#dot11 ssid GUEST

ITKE-AP-01(config-ssid)#authentication open

ITKE-AP-01(config-ssid)#vlan 102

(The above commands will create an ssid GUEST, assigned to VLAN 102 and with an open authentication).

ITKE-AP-01(config)#interface gigabitEthernet 0.101

ITKE-AP-01(config-subif)#encapsulation dot1Q 101

ITKE-AP-01(config-subif)#bridge-group 101

ITKE-AP-01(config-subif)#exit

ITKE-AP-01(config)#

(The above commands will set the encapsulation dot1q for VLAN 101 and assigns the sub interface to bridge group 101 to the giga Ethernet).

ITKE-AP-01(config)#interface dot11Radio 0.101

ITKE-AP-01(config-subif)#encapsulation dot1Q 101

ITKE-AP-01(config-subif)#bridge-group 101

ITKE-AP-01(config-subif)#exit

ITKE-AP-01(config)#

(The above commands will set the encapsulation dot1q for VLAN 101 and assigns the sub interface to bridge group 101 to the sub interface on the radio interface).

ITKE-AP-01(config)#interface gigabitEthernet 0.102

ITKE-AP-01(config-subif)#encapsulation dot1Q 102

ITKE-AP-01(config-subif)#bridge-group 102

ITKE-AP-01(config-subif)#exit

ITKE-AP-01(config)#

(The above commands will set the encapsulation dot1q for VLAN 102 and assigns the sub interface to bridge group 102 to the giga Ethernet).

ITKE-AP-01(config)#interface dot11Radio 0.102

ITKE-AP-01(config-subif)#encapsulation dot1Q 102

ITKE-AP-01(config-subif)#bridge-group 102

ITKE-AP-01(config-subif)#exit

ITKE-AP-01(config)#

(The above commands will set the encapsulation dot1q for VLAN 101 and assigns the sub interface to bridge group 101 to the sub interface on the radio interface).

3^rd Step: Assign the multiple SSIDs to the radio interface on the Cisco Aironet 1250 Series Access Point

ITKE-AP-01(config)#interface dot11Radio 0

ITKE-AP-01(config-if)#ssid ADMIN

ITKE-AP-01(config-if)#ssid GUEST

ITKE-AP-01(config-if)#mbssid

(The above commands assigns the multiple SSIDs ADMIN and GUEST  to the radio interface dot11radio 0 ).

Note: The SSIDs ADMIN and GUEST are configured for open authentication, For information on how to configure different authentication types on the Cisco Aironet 1250 Series Access Point , refer the Cisco document “Configuring Authentication Types”.

In next post we will look at the configuration for the Cisco 3560 Switch .

In order to configure multiple SSIDs in a Cisco Aironet 1250 Series Access Point, we will follow the following scenario,

The Scenario is based on following hardware and software versions.

Cisco Aironet 1250 Series Access Point runs with an IOS Version 12.4(10b) JDA3.

Cisco Catalyst 3560 Switch runs with an IOS version 12.2(44) SE1.

Cisco Catalyst 6500 Series Switch runs with an IOS version 12.2(18) SXF14.

The Cisco Aironet 1250 Series Access Point has three VLANs, – VLAN 100, VLAN 101 and VLAN 102. VLAN 100 will be the native VLAN, VLAN 101 for the ITKE admin department and VLAN 102 for the guest users. The Wireless users who belong to ITKE admin department must connect to the Cisco Aironet 1250 Series Access Point and should be able to connect the ITKE admin department users on the wired network which is VLAN 101.

The wireless guest users should be able to connect to the Internet Gateway or web server which is on the wired segment of VLAN 102.

A Cisco Catalyst 3560 Switch is connected to the Cisco Aironet 1250 Series Access Point at the access layer and the Cisco Catalyst 3560 Switch is also connected to the Cisco Catalyst 6500 Switch at the Core/Distribution layer). All VLANs are created in the Cisco Catalyst 6500 Switch which is beyond the scope of this document. (If any one feels he or she needs the sample configuration for the VLANs in the Cisco Catalyst 6500 switch it can be provided in the comments section of this blog entry).

A windows 2003 Server is used as a DHCP server which provides the IP address for both the VLANs VLAN 101 and VLAN 102. A DHCP scope has to be configured for both VLANS in the windows 2003 Server which is also beyond the scope of this document. But I am just adding the snap shot from the DHCP Server.

The following IP Address Scheme is applied for the VLANs

VLAN 100– 10.0.0.0 /23 (NATIVE VLAN)

VLAN 101 – 10.2.0.0/23

VLAN 102– 10.4.0.0/23

Following are the IP address used for the devices in this document.

·         The Cisco Aironet 1250 Series Access Point Bridge-Group Virtual Interface (BVI) IP Address (VLAN 100) 10.0.0.99.

·         Windows 2003 DHCP Server with an IP address 10.0.1.100 with VLAN scopes configured

·         Web Server with an IP Address 10.4.0.100.

·         Wireless Clients (SSID ITKE) gets connected to VLAN 101 gets an IP address from the Windows 2003 DHCP Server from the subnet 10.2.0.0.

·         Wireless Clients (SSID Guest) gets connected to VLAN 102 gets an IP Address from the Windows 2003 DHCP Server from the subnet 10.4.0.0.

In my next post I will post the configuration steps required to carry out the above motioned task. Until then do leave your comments for any future improvements or suggestions.