I have been racking my brain since last night and all morning with this problem...luckily it's not in a production environment yet.
I have done many searches and have come up with the same responses regarding Cisco APs and multiple SSIDs, and I think I have tried everything there is, but obviously I haven't.
In this environment, there is a Cisco 3550 as the core router.
The AP in question is a AIR-LAP1142N-A-K9 which has been configured for autonomous mode (this facility doesn't have a wifi manager), and it is sitting on a Cisco 2960 POE switch.
**2950 POE Switchport config for applicable ports**:
interface GigabitEthernet1/0/12
description WiFi
switchport access vlan 101
switchport trunk native vlan 11
switchport trunk allowed vlan 11,102,228,700
switchport mode trunk
end
interface GigabitEthernet1/0/28
description LINK TO CORE
switchport trunk allowed vlan 10,11,101-106,228,700,1002-1005
switchport mode trunk
end
**Cisco 3550 Switchport config for applicable port:**
interface GigabitEthernet0/9
description Link to 2960-MB-POE
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 10,11,101-106,228,700,1002-1005
switchport mode trunk
end
All other VLANS are working as designed/intended. VLAN 700 is guest wifi, and it is pulling DHCP from 3550. All other VLANS (except for VLAN in question) are pulling DHCP from MS Server 2008
From AP, I can ping core router IP (192.168.228.1) on VLAN, so trunking is working. I can also ping all the way to MS 2008 DHCP server, so trunking is good all the way to server
I can associate with AP (can see my MAC address in AP when run "sho dot11 associations" command) and if I set my IP address to a static IP address, the sho dot11 associations command shows my IP address
I can associate with AP and get IP address for VLAN 102
I cannot get an IP address for VLAN 228
I have tried it with forwarders set up identical as all other VLANS (to get DHCP from server), and that's not working either, so I left it at DHCP from core.
VLANs are set on cisco 3550 as the following
interface Vlan102
description VLAN102
ip address 192.168.102.1 255.255.255.0
ip helper-address 192.168.9.98
ip helper-address 192.168.9.103
ip helper-address 192.168.9.85
no ip redirects
no ip unreachables
no ip proxy-arp
interface Vlan228
desciption VLAN228
ip address 192.168.228.1 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
!
For testing, DHCP is set up as this (on core 3550)
ip dhcp pool vlan228
network 192.168.228.0 255.255.255.0
default-router 192.168.228.1
dns-server 8.8.8.8 8.8.4.4
lease 0 8
Based on everything above, to me it means that there is something wrong with my AP config. My best guess is that it has something to do with sub-interfaces or bridge groups. If that's not it, the it could be the routing on 3550, but this would be the first time in my experience that I would have to tell the core router about a vlan that was created on it. Any help would be most appreciated.
--------BEGIN AP CONFIGURATION----------
Current configuration : 4949 bytes
!
! Last configuration change at 09:58:29 GMT-0 Wed Jul 23 2014
! NVRAM config last updated at 09:56:11 GMT-0 Wed Jul 23 2014
! NVRAM config last updated at 09:56:11 GMT-0 Wed Jul 23 2014
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname AP12345
!
!
logging rate-limit console 9
no logging console
enable secret 5 passwordhasbeenremoved
!
no aaa new-model
clock timezone GMT -0 0
clock summer-time GMT-0 recurring last Sun Mar 2:00 last Sun Oct 3:00
no ip cef
ip domain name myorganization.com
ip name-server 192.168.x.x
ip name-server 192.168.x.x
!
!
!
!
dot11 mbssid
dot11 syslog
dot11 vlan-name VLANNAME1 vlan 102
dot11 vlan-name VLANNAME2 vlan 228
dot11 vlan-name MANAGEMENT vlan 11
!
dot11 ssid SSID1
vlan 102
authentication open
authentication key-management wpa version 2
mbssid guest-mode
wpa-psk ascii 7 passwordhasbeenremoved
!
dot11 ssid SSID2
vlan 228
authentication open
authentication key-management wpa version 2
mbssid guest-mode
wpa-psk ascii 7 passwordhasbeenremoved
!
!
dot11 guest
!
!
!
username user1 privilege 15 secret 5 passwordremoved
username user2 privilege 15 secret 5 passwordremoved
!
!
bridge irb
!
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
encryption vlan 102 mode ciphers aes-ccm
!
encryption vlan 228 mode ciphers aes-ccm
!
ssid SSID1
!
ssid SSID2
!
antenna gain 0
speed basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
power local 8
channel 2412
station-role root
infrastructure-client
!
interface Dot11Radio0.11
encapsulation dot1Q 11 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.102
encapsulation dot1Q 102
no ip route-cache
bridge-group 102
bridge-group 102 subscriber-loop-control
bridge-group 102 spanning-disabled
bridge-group 102 block-unknown-source
no bridge-group 102 source-learning
no bridge-group 102 unicast-flooding
!
interface Dot11Radio0.228
encapsulation dot1Q 228
no ip route-cache
bridge-group 228
bridge-group 228 subscriber-loop-control
bridge-group 228 spanning-disabled
bridge-group 228 block-unknown-source
no bridge-group 228 source-learning
no bridge-group 228 unicast-flooding
!
interface Dot11Radio1
no ip address
no ip route-cache
!
encryption vlan 102 mode ciphers aes-ccm
!
encryption vlan 228 mode ciphers aes-ccm
!
ssid SSID1
!
ssid SSID2
!
antenna gain 0
peakdetect
no dfs band block
channel 5745
station-role root
!
interface Dot11Radio1.11
encapsulation dot1Q 11 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 spanning-disabled
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
!
interface Dot11Radio1.102
encapsulation dot1Q 102
no ip route-cache
bridge-group 102
bridge-group 102 subscriber-loop-control
bridge-group 102 spanning-disabled
bridge-group 102 block-unknown-source
no bridge-group 102 source-learning
no bridge-group 102 unicast-flooding
!
interface Dot11Radio1.228
encapsulation dot1Q 228
no ip route-cache
bridge-group 228
bridge-group 228 subscriber-loop-control
bridge-group 228 spanning-disabled
bridge-group 228 block-unknown-source
no bridge-group 228 source-learning
no bridge-group 228 unicast-flooding
!
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
bridge-group 1
bridge-group 1 spanning-disabled
no bridge-group 1 source-learning
!
interface GigabitEthernet0.11
encapsulation dot1Q 11
no ip route-cache
bridge-group 11
bridge-group 11 spanning-disabled
no bridge-group 11 source-learning
!
interface GigabitEthernet0.102
encapsulation dot1Q 102
no ip route-cache
no cdp enable
bridge-group 102
bridge-group 102 spanning-disabled
no bridge-group 102 source-learning
!
interface GigabitEthernet0.228
encapsulation dot1Q 228
no ip route-cache
no cdp enable
bridge-group 228
bridge-group 228 spanning-disabled
no bridge-group 228 source-learning
!
interface BVI1
ip address 192.168.9.133 255.255.255.0
no ip route-cache
ipv6 address dhcp
ipv6 address autoconfig
ipv6 enable
!
ip default-gateway 192.168.9.1
ip forward-protocol nd
no ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
!
!
bridge 1 route ip
!
!
!
line con 0
privilege level 15
line vty 0 4
login local
transport input ssh
line vty 5 15
login
transport input ssh
!
sntp server 165.193.126.229
sntp server 216.171.112.36
sntp server 206.246.122.250
end
------------------END AP CONFIGURATION---------------
