UNP Profile for Access Points

[Cristek]

I see an issue with your config. The 2260/2360 doesn't support the unp 'mobile-tag' parameter which you are missing.
Currently, your LLDP config tells the phone to tag itself to 869 but your UNP config is telling it to work untagged instead.

Assuming that you don't actually need the phones tagged, simply remove all your LLDP configuration (all 3 commands).
Those switches -by default- already prioritize ALE phones in terms of QOS so you wont loose anything there.

If you -for whatever reason- do need the phones to tag themselves while interacting with UNP then you need a 6360 or higher.

Also (and not related to your issue at all), as far as I'm aware -someone more experienced can confirm this- once you use UNP on a port, say 5 and 6 in this example below, then vlan commands like:
- vlan 1111 members port 1/1/5 tagged
- vlan 2222 members port 1/1/6 untagged
are completely ignored since UNP is what they pay attention to, so you can even clean up your config a bit!

[silvio]

Thanks for the outputs.

Code: Select all

Port: 1/1/20
MAC-Address: 24:9a:d8:91:d9:82
..
Vlan = 869,
..
Profile Source = Default UNP - Block,

That means your classification rule

Code: Select all

unp classification lldp med-endpoint ip-phone profile1 "Voice-869"

isn't matching. So the phone has to go to the default unp Data-10. But this isn't possible because the vlan tag of the phones in vlan 869 (initiated by your lldp rule).

You write the issue is only seen at the 2360 switches. So I assume that the phones are sending the lldp info correctly. Do you use the actual firmware at the switches? Maybe this is a known issue.
As workaraund you can try with a second classification with the vendor mac 24:9a:d8 into the phone profile.
BR Silvio

[element1064]

I see an issue with your config. The 2260/2360 doesn't support the unp 'mobile-tag' parameter which you are missing.
Currently, your LLDP config tells the phone to tag itself to 869 but your UNP config is telling it to work untagged instead.

Assuming that you don't actually need the phones tagged, simply remove all your LLDP configuration (all 3 commands).
Those switches -by default- already prioritize ALE phones in terms of QOS so you wont loose anything there.

If you -for whatever reason- do need the phones to tag themselves while interacting with UNP then you need a 6360 or higher.

Also (and not related to your issue at all), as far as I'm aware -someone more experienced can confirm this- once you use UNP on a port, say 5 and 6 in this example below, then vlan commands like:
- vlan 1111 members port 1/1/5 tagged
- vlan 2222 members port 1/1/6 untagged
are completely ignored since UNP is what they pay attention to, so you can even clean up your config a bit!

Hi and thank you for your reply, yes the UNP mobile tag is not available on the 2260/2360 switches, all phones are currently manually tagged so with AP mode enabled in the UNP template, the switch should tag the port for Voice automatically because of AP mode and the phone is already manually tagged.

[element1064]

Thanks for the outputs.

Code: Select all

Port: 1/1/20
MAC-Address: 24:9a:d8:91:d9:82
..
Vlan = 869,
..
Profile Source = Default UNP - Block,

That means your classification rule

Code: Select all

unp classification lldp med-endpoint ip-phone profile1 "Voice-869"

isn't matching. So the phone has to go to the default unp Data-10. But this isn't possible because the vlan tag of the phones in vlan 869 (initiated by your lldp rule).

You write the issue is only seen at the 2360 switches. So I assume that the phones are sending the lldp info correctly. Do you use the actual firmware at the switches? Maybe this is a known issue.
As workaraund you can try with a second classification with the vendor mac 24:9a:d8 into the phone profile.
BR Silvio

Hi thank you, I have upgraded the switches firmware to latest OS2260/2360_5.2.25.R05_GA, I even upgraded the U-Boot as well as the FPGA, can you however confirm that you think my configuration on the switches are OK in your opinion, is there something that you will change?
What will be the complete CLI command be for the mac address into the phone profile?

[silvio]

Try the following:

Code: Select all

unp classification mac-oui 24:9a:d8 profile1 "Voice-869"

[Cristek]

Hi and thank you for your reply, yes the UNP mobile tag is not available on the 2260/2360 switches, all phones are currently manually tagged so with AP mode enabled in the UNP template, the switch should tag the port for Voice automatically because of AP mode and the phone is already manually tagged.

As far as I understand it, my interpretation of the manual is that "ap-mode" is only relevant for APs that are classified with the build-in defaultWLANProfile profile, and it makes whatever tagged traffic received from an AP accepted and forwarded. For everything else you need "trust-tag" which the 2260/2360 also doesn't support.
Even Silvio's suggestion of using unp classification mac-oui is also not supported on those switches. "mac-oui" is not supported either.
So, with all these limitations in mind, you can try and remove the LLDP config and see if it solves the problem. There's nothing to loose in trying it. Do tell me if it works as I'm using this post to learn as well!

The way I see it, if all you want to do is 'auto-voice vlan', then you can do it with LLDP -those 3 commands you have- and not even bother using UNP at all! The phone gets tagged on the voice vlan via LLDP -you don't even need to manually tag each phone- and you control the data vlan with the standard command "vlan x members port 1/1/x"

But your original post was about adding APs to this mix and for this, then you do need UNP. But since these switches don't support 'mobile-tag' then you need to manually untag all the phones, drop the LLDP config, and let unp classification pick them up and assign them to the voice vlan. I had an issue with tagged phones and UNP classification happen to me so that's why I'm sure you need to manually untag the phones or UNP wont pick them up.

[silvio]

Cristek is correct. There are a lot of limitations at the 2260/2360 with R5.x against the other omniswitches with R8 (f.e. 6360). Beside the limitation at the classisification rules is the mobile-tag at the unp-profile missing and trust-tag at the unp-template not possible too.
So the idea to use untagged phones (delete your lldp-config and restart the phones) and use the onliest possible classification with lldp will be the best way.
BR Silvio

[element1064]

Hi and thank you for your reply, yes the UNP mobile tag is not available on the 2260/2360 switches, all phones are currently manually tagged so with AP mode enabled in the UNP template, the switch should tag the port for Voice automatically because of AP mode and the phone is already manually tagged.

As far as I understand it, my interpretation of the manual is that "ap-mode" is only relevant for APs that are classified with the build-in defaultWLANProfile profile, and it makes whatever tagged traffic received from an AP accepted and forwarded. For everything else you need "trust-tag" which the 2260/2360 also doesn't support.
Even Silvio's suggestion of using unp classification mac-oui is also not supported on those switches. "mac-oui" is not supported either.
So, with all these limitations in mind, you can try and remove the LLDP config and see if it solves the problem. There's nothing to loose in trying it. Do tell me if it works as I'm using this post to learn as well!

The way I see it, if all you want to do is 'auto-voice vlan', then you can do it with LLDP -those 3 commands you have- and not even bother using UNP at all! The phone gets tagged on the voice vlan via LLDP -you don't even need to manually tag each phone- and you control the data vlan with the standard command "vlan x members port 1/1/x"

But your original post was about adding APs to this mix and for this, then you do need UNP. But since these switches don't support 'mobile-tag' then you need to manually untag all the phones, drop the LLDP config, and let unp classification pick them up and assign them to the voice vlan. I had an issue with tagged phones and UNP classification happen to me so that's why I'm sure you need to manually untag the phones or UNP wont pick them up.

Hi

So I have been running tests the past two weeks, the only thing I did was I removed the VLAN from the phones, my config on the switches remained the same. I rebooted the switches and the phones are put into VLAN 869 as untagged and have not had issues of VLAN 869 being blocked as yet.

Thank you so much for your input regarding my post, I have learned quite a bit.

Server_Room -> show vlan 869 members
port type status
----------+-----------+---------------
1/1/1 unpUntag forwarding
1/1/2 unpUntag forwarding
1/1/6 unpUntag forwarding
1/1/7 unpUntag forwarding
1/1/8 unpUntag forwarding
1/1/10 unpUntag forwarding
1/1/22 unpUntag forwarding
1/1/29 unpUntag forwarding
1/1/33 unpUntag forwarding
1/1/34 unpUntag forwarding
1/1/35 unpUntag forwarding
1/1/36 unpUntag forwarding
1/1/49 qtagged forwarding
1/1/50 qtagged inactive
1/1/51 qtagged inactive
1/1/52 qtagged inactive
1/1/53 qtagged inactive
1/1/54 qtagged inactive

Server_Room -> show configuration snapshot da-unp
! DA-UNP:
unp profile "Data-10"
unp profile "Voice-869"
unp profile "defaultWLANProfile"
unp profile "Data-10" map vlan 10
unp profile "Voice-869" map vlan 869
unp profile "defaultWLANProfile" map vlan 100
unp port-template DataTemplate direction both default-profile "Data-10" classification ap-mode admin-state enable
unp port 1/1/1-48 port-type bridge
unp port 1/1/1-48 port-template DataTemplate
unp classification lldp med-endpoint ip-phone profile1 "Voice-869"

Server_Room -> show configuration snapshot lldp
! LLDP:
lldp network-policy 1 application voice vlan 869 l2-priority 5 dscp 46
lldp nearest-bridge chassis tlv med network-policy enable
lldp chassis med network-policy 1

[element1064]

Cristek is correct. There are a lot of limitations at the 2260/2360 with R5.x against the other omniswitches with R8 (f.e. 6360). Beside the limitation at the classisification rules is the mobile-tag at the unp-profile missing and trust-tag at the unp-template not possible too.
So the idea to use untagged phones (delete your lldp-config and restart the phones) and use the onliest possible classification with lldp will be the best way.
BR Silvio

Hi

So I have been running tests the past two weeks, the only thing I did was I removed the VLAN from the phones, my config on the switches remained the same. I rebooted the switches and the phones are put into VLAN 869 as untagged and have not had issues of VLAN 869 being blocked as yet.

Thank you so much for your input regarding my post, I have learned quite a bit.

Server_Room -> show vlan 869 members
port type status
----------+-----------+---------------
1/1/1 unpUntag forwarding
1/1/2 unpUntag forwarding
1/1/6 unpUntag forwarding
1/1/7 unpUntag forwarding
1/1/8 unpUntag forwarding
1/1/10 unpUntag forwarding
1/1/22 unpUntag forwarding
1/1/29 unpUntag forwarding
1/1/33 unpUntag forwarding
1/1/34 unpUntag forwarding
1/1/35 unpUntag forwarding
1/1/36 unpUntag forwarding
1/1/49 qtagged forwarding
1/1/50 qtagged inactive
1/1/51 qtagged inactive
1/1/52 qtagged inactive
1/1/53 qtagged inactive
1/1/54 qtagged inactive

Server_Room -> show configuration snapshot da-unp
! DA-UNP:
unp profile "Data-10"
unp profile "Voice-869"
unp profile "defaultWLANProfile"
unp profile "Data-10" map vlan 10
unp profile "Voice-869" map vlan 869
unp profile "defaultWLANProfile" map vlan 100
unp port-template DataTemplate direction both default-profile "Data-10" classification ap-mode admin-state enable
unp port 1/1/1-48 port-type bridge
unp port 1/1/1-48 port-template DataTemplate
unp classification lldp med-endpoint ip-phone profile1 "Voice-869"

Server_Room -> show configuration snapshot lldp
! LLDP:
lldp network-policy 1 application voice vlan 869 l2-priority 5 dscp 46
lldp nearest-bridge chassis tlv med network-policy enable
lldp chassis med network-policy 1

Server_Room -> show unp user
User
Port Username Mac address IP Vlan Profile Type Status
-------+--------------------+-----------------+---------------+----+--------------------------------+------------+-----------
1/1/1 14:b3:1f:0a:bf:3f 14:b3:1f:0a:bf:3f 10.0.1.182 10 Data-10 Bridge Active
1/1/1 24:9a:d8:86:3d:fe 24:9a:d8:86:3d:fe 192.168.105.120 869 Voice-869 Bridge Active
1/1/2 24:9a:d8:91:db:29 24:9a:d8:91:db:29 192.168.105.18 869 Voice-869 Bridge Active
1/1/6 24:9a:d8:91:da:a1 24:9a:d8:91:da:a1 192.168.105.47 869 Voice-869 Bridge Active
1/1/6 6c:4b:90:5a:65:d2 6c:4b:90:5a:65:d2 10.0.1.162 10 Data-10 Bridge Active
1/1/7 24:9a:d8:93:d0:f3 24:9a:d8:93:d0:f3 192.168.105.138 869 Voice-869 Bridge Active
1/1/8 24:9a:d8:91:db:aa 24:9a:d8:91:db:aa 192.168.105.143 869 Voice-869 Bridge Active
1/1/8 64:00:6a:46:46:5b 64:00:6a:46:46:5b 10.0.1.140 10 Data-10 Bridge Active
1/1/9 00:80:91:b6:8b:53 00:80:91:b6:8b:53 10.0.0.11 10 Data-10 Bridge Active
1/1/10 24:9a:d8:93:d1:3b 24:9a:d8:93:d1:3b 192.168.105.82 869 Voice-869 Bridge Active
1/1/19 d8:cb:8a:20:5c:d6 d8:cb:8a:20:5c:d6 10.0.1.227 10 Data-10 Bridge Active
1/1/22 24:9a:d8:91:db:8b 24:9a:d8:91:db:8b 192.168.105.141 869 Voice-869 Bridge Active
1/1/23 00:80:91:da:67:20 00:80:91:da:67:20 10.0.0.20 10 Data-10 Bridge Active
1/1/26 6c:4b:90:2d:2b:b4 6c:4b:90:2d:2b:b4 10.0.1.252 10 Data-10 Bridge Active
1/1/27 24:9a:d8:a6:65:5e 24:9a:d8:a6:65:5e 192.168.105.52 869 Voice-869 Bridge Active
1/1/29 24:9a:d8:93:c8:34 24:9a:d8:93:c8:34 192.168.105.83 869 Voice-869 Bridge Active
1/1/30 18:66:da:42:92:91 18:66:da:42:92:91 10.0.1.132 10 Data-10 Bridge Active
1/1/33 24:9a:d8:95:fa:43 24:9a:d8:95:fa:43 192.168.105.63 869 Voice-869 Bridge Active
1/1/34 24:9a:d8:95:fe:a2 24:9a:d8:95:fe:a2 192.168.105.17 869 Voice-869 Bridge Active
1/1/35 24:9a:d8:95:fb:9a 24:9a:d8:95:fb:9a 192.168.105.26 869 Voice-869 Bridge Active
1/1/36 24:9a:d8:95:fd:51 24:9a:d8:95:fd:51 192.168.105.65 869 Voice-869 Bridge Active
1/1/37 78:8c:77:d2:15:5c 78:8c:77:d2:15:5c 10.0.0.19 10 Data-10 Bridge Active
1/1/39 60:22:32:87:d9:61 60:22:32:87:d9:61 10.0.100.11 100 defaultWLANProfile Bridge Active
1/1/40 60:22:32:87:e0:cd 60:22:32:87:e0:cd 10.0.100.4 100 defaultWLANProfile Bridge Active
1/1/41 60:22:32:7e:8f:09 60:22:32:7e:8f:09 10.0.100.12 100 defaultWLANProfile Bridge Active
1/1/42 60:22:32:87:e7:5d 60:22:32:87:e7:5d 10.0.100.5 100 defaultWLANProfile Bridge Active
1/1/44 ac:b9:2f:dc:9c:01 ac:b9:2f:dc:9c:01 10.0.0.40 10 Data-10 Bridge Active
1/1/44 ac:b9:2f:dc:9c:27 ac:b9:2f:dc:9c:27 10.0.0.43 10 Data-10 Bridge Active
1/1/44 ac:b9:2f:dc:9c:55 ac:b9:2f:dc:9c:55 10.0.0.41 10 Data-10 Bridge Active
1/1/44 ac:b9:2f:dc:9c:bd ac:b9:2f:dc:9c:bd 10.0.0.51 10 Data-10 Bridge Active
1/1/44 e0:46:ee:25:b8:15 e0:46:ee:25:b8:15 10.0.0.55 10 Data-10 Bridge Active
1/1/44 e0:46:ee:25:b8:17 e0:46:ee:25:b8:17 - 10 Data-10 Bridge Active

[Cristek]

Thank you so much for your input regarding my post, I have learned quite a bit.

Same as me my friend! I'm slowly learning but I wish ALE had courses available.
According to my service manager, at the moment the courses are online only, and not a single one in English is yet in sight!
The solution? Bother these pros here in the forum for answers and knowledge!