Cisco Mesh - Ethernet VLAN tagging

The following documents the steps required to get Ethernet VLAN tagging working in a Cisco mesh deployment. This allows you to hang either a single wired client or a switch off of a MAP and allow it to communicate with the rest of the network, via the mesh. This is essentially the mesh-based equivalent of a work-group bridge. The configuration documented below is for connection of a switch to the MAP.

The Cisco documentation for this configuration is ridiculously confusing, contradictory and contains numerous mistakes so much of the following was determined by nutting it out. As such, there may be modifications to the configuration below that also work, depending on requirements but the following has been tested and deployed. There is a BugID for the poor state of the documentation - 'nuff said!

Assumptions

• You have a working knowledge of Cisco mesh deployments
• Having read through the Cisco documentation on Ethernet VLAN tagging and banged your head against the wall may also help
• The following configuration is based on this example topology
• [ACCESS-LAYER SWITCH] --> [MAP] --> [MAP] --> [RAP] --> [CORE SWITCH]

Configuration

VLAN Transparent

• Disable the global parameter VLAN Transparent
• WLC GUI --> WIRELESS --> Mesh --> Un-tick 'VLAN Transparent'

Ethernet Bridging

• Enable Ethernet Bridging on ALL RAPs and MAPs in the mesh network
• If Ethernet Bridging is not enabled on all MAPs and RAPs and the MAP changes its backhaul path through the network, the MAPs and RAPs in the new path may not be able to dynamically create the required VLANs / sub-interfaces on their radio interfaces

• WLC GUI --> WIRELESS --> Access Points --> All APs --> <ap-hostname> --> Mesh -> Tick 'Ethernet Bridging'
• Depending on the number of APs, a quicker way may be to use the WLC CLI command:
• config ap bridging enable <ap-hostname>

 RAP Wired Ethernet Interface (Configured on the WLC)

• If not already set, configure ALL RAPs wired Ethernet interfaces (usually GigabitEthernet0 or GigabitEthernet3) to Normal Mode. This is the default so they probably won't need to be changed
• Contradictions exist in Cisco documentation as to whether Trunk or Normal mode is required. Both work but changing from Normal to Trunk produces a warning that indicates the change hasn't taken place so in effect, the port is still set to Normal, despite being set to Trunk
• The RAP does actually trunk traffic to the switch but the VLANs / sub-interfaces on the GigabitEthernetX wired Ethernet interface are created automatically using a VLAN registration mechanism.
• WLC GUI --> WIRELESS --> Access Points --> All APs --> <rap-hostname> --> Mesh --> <GigabitEthernetX> --> Mode --> Normal

RAP Wired Switchport Interface (Configured on the switch)

• The switchport(s) on the [CORE SWITCH] that the RAP(s) wired Ethernet interface connects to must be configured as a trunkport.
• In the switchport configuration example below:
• VLAN 100 is the Native VLAN and the VLAN that the RAPs and MAPs management IP resides in
• VLAN 200 is the Management VLAN used by the [ACCESS-LAYER SWITCH](es) attached to the MAPs
• VLAN 300 is the User-access VLAN used by wired clients that connect to the [ACCESS-LAYER SWITCH]. Multiple User-access VLANs may be used, if required

• Example switchport configuration:
• interface GigabitEthernet0/1
•  description *** Connection to RAP01 ***
•  switchport trunk encapsulation dot1q
•  switchport trunk native vlan 100
•  switchport trunk allowed vlan 100,200,300
•  switchport mode trunk

• Assuming the [CORE SWITCH] is the appropriate layer 3 point in the network, SVIs for all three VLANs should be created

MAP Wired Ethernet Interface (Configured on the WLC)

• Only the MAP(s) that have an [ACCESS-LAYER SWITCH] connected to them require VLANs configured. All of the other MAPs that act as backhauls for the MAP(s) connected to the [ACCESS-LAYER SWITCH] will automatically pass the VLAN-tagged packets through their radio interfaces.
• Configure the MAP(s) that have an [ACCESS-LAYER SWITCH] connected, by configuring the wired Ethernet interface (usually GigabitEthernet0).
• Configure the same native VLAN and additional VLAN IDs as that configured in the RAP Wired Switchport Interface section above
• These additional VLANs are:
• Management VLAN used by the [ACCESS-LAYER SWITCH] that attaches to the MAPs
• User-access VLAN used by wired clients that connect to the [ACCESS-LAYER SWITCH]

• WLC GUI --> WIRELESS --> Access Points --> All APs --> <map-hostname> --> Mesh --> <GigabitEthernetX> --> Mode --> Trunk
• WLC GUI --> WIRELESS --> Access Points --> All APs --> <map-hostname> --> Mesh --> <GigabitEthernetX> --> Mode --> Native VLAN Id --> <VLAN100>
• WLC GUI --> WIRELESS --> Access Points --> All APs --> <map-hostname> --> Mesh --> <GigabitEthernetX> --> Mode --> Trunk VLAN Id --> <VLAN200>
• WLC GUI --> WIRELESS --> Access Points --> All APs --> <map-hostname> --> Mesh --> <GigabitEthernetX> --> Mode --> Trunk VLAN Id --> <VLAN300>

MAP Wired Switchport Interface (Configured on the switch)

• The switchport(s) on the [ACCESS-LAYER SWITCH] that the MAP(s) wired Ethernet interface connects to must be configured as a trunkport.
• In the switchport configuration example below:
• VLAN 100 is the native VLAN and the VLAN that the RAPs and MAPs management IP resides in
• VLAN 200 is the Management VLAN used by the [ACCESS-LAYER SWITCH] currently being configured
• VLAN 300 is the VLAN used by wired clients that connect to the [ACCESS-LAYER SWITCH] currently being configured

• Example switchport configuration:
• interface GigabitEthernet0/48
•  description *** Connection to MAP01 ***
•  switchport trunk native vlan 100
•  switchport trunk allowed vlan 100,200,300
•  switchport mode trunk

• An SVI & default gateway for management of the [ACCESS-LAYER SWITCH] should also be configured:
• interface Vlan200
•  description ***** [ACCESS-LAYER SWITCH] Management *****
•  ip address 192.168.1.10 255.255.255.0

• ip default-gateway 192.168.1.1

• It is recommended that VTP is set to transparent on this switch

EOF... almost
Cisco Mesh Ethernet VLAN Tagging configuration - what could be simpler? :|