Common VLAN Configuration Error Cases and Handling Suggestions

Fault Symptom

The management VLAN is incorrectly configured, causing APs' failures to go online.

Procedure

By default, management packets of APs are untagged, and the access switch directly connected to the APs tags VLAN IDs on the management packets. After the management-vlan vlan-id command is executed, the management and control packets sent from APs to the AC contain the management VLAN tag. You can use this command based on the networking. This configuration takes effect only after an AP is restarted.

Error-prone configuration: A management VLAN is incorrectly configured, causing disconnection of intermediate networks.

Suggestion:

• Modify the management VLAN and add the VLAN to the allowed list on the AC and access switches. In this manner, APs can communicate with the AP through the modified management VLAN.
• Configure VLAN mapping on the access switches to replace the original management VLAN with the correct VLAN.
  1. Delete the management VLAN configured on the AC.
  2. Create the correct management VLAN and configure VLAN mapping on the interface of the access switch. (If multiple interfaces are involved, run the interface range command and then configure the VLAN and VLAN mapping.)

     # 
     interface GigabitEthernet0/0/1                                                    
      qinq vlan-translation enable 
      port vlan-mapping vlan 400 map-vlan 1100

Fault Symptom

The network is disconnected after STAs roam at Layer 3.

Procedure

1. Check the service VLAN configuration on the AC.

   Error-prone configuration: Service VLANs are not created or not added to the allowed list, causing network disconnection after STAs roam at Layer 3.

   Suggestion: Create the service VLANs and add them to the allowed list on the AC and intermediate switches.

Fault Symptom

All STAs associated with an AP cannot obtain IP addresses automatically in DHCP mode.

Procedure

1. Check whether the undo dhcp trust port command is configured.

   Error-prone configuration: The undo dhcp trust port command is configured in the AP wired port profile, causing STAs' failures to obtain IP addresses.

   [AC6605-wlan-view] wired-port-profile name p1 
   [AC6605-wlan-wired-port-p1] undo dhcp trust port

   Suggestion: Configure the dhcp trust port command.

2. Check whether VLANs are created and added to the allowed list on intermediate networks.
   • Direct forwarding
     • Check whether service VLANs are created on the AC and intermediate devices.
     • Check whether VLANs are in the allowed list of the AC and intermediate devices.
   • Tunnel forwarding

     Check whether service VLANs are created and added to the allowed list on the AC.

   Error-prone configuration: Service VLANs are not created or not added to the allowed list on the AC, causing disconnection of intermediate networks.

   Suggestion: Create service VLANs and add them to the allowed list on the AC.

Fault Symptom

A dynamic VLAN is created on the authentication server, but the same VLAN is not created on the AC. As a result, authentication fails.

Procedure

1. Check whether the dynamic VLAN is created on the AC.

   Error-prone configuration: The AC does not have a dynamic VLAN created.

   Suggestion: Create the corresponding VLAN on the AC.