UNP Profile for Access Points

[element1064]

Good day

I have a customer running multiple OS2360 switches with 2 VLANS, one for Data and One for Voice, the customer would like to add Access Points to the network. I dis read in the manual that there is a default (defaultWLANProfile) profile for Access Points, can anybody advise on how to create a UNP for Access Points with a default Access Point VLAN and also tagged VLANS,

Below is a snapshot of one of the switches, I would Like to add a UNP with AP default VLAN of 20 with SSIDs Guest (VLAN 21) and Corporate (VLAN 22), has anyone done this before?

Regards

Chassis:
system name "OS2360"

! Configuration:
configuration error-file-limit 2

! Capability Manager:
! Virtual Flow Control:
! Interface:
interfaces port 1/1/24 alias "Management-161"

! Port_Manager:
! Link Aggregate:
! VLAN:
vlan 1 admin-state enable
vlan 10 admin-state enable
vlan 10 name "Data-10"
vlan 161 admin-state enable
vlan 161 name "Management-161"
vlan 869 admin-state enable
vlan 869 name "Voice-869"
vlan 161 members port 1/1/24-26 untagged
vlan 10 members port 1/1/25-26 tagged
vlan 869 members port 1/1/25-26 tagged

! Spanning Tree:
spantree vlan 1 admin-state enable
spantree vlan 10 admin-state enable
spantree vlan 161 admin-state enable
spantree vlan 869 admin-state enable

! DA-UNP:
unp profile "Data-10"
unp profile "Voice-869"
unp profile "Data-10" map vlan 10
unp profile "Voice-869" map vlan 869
unp port-template DataTemplate direction both default-profile "Data-10" classification ap-mode admin-state enable
unp port-template DataTemplate vlan 869 tagged
unp port 1/1/1-23 port-type bridge
unp port 1/1/1-23 port-template DataTemplate
unp classification lldp med-endpoint ip-phone profile1 "Voice-869"

! Bridging:
! Port Mirroring:
! Port Mapping:
! IP:
ip interface "Management-161" address 192.168.161.7 mask 255.255.255.0 vlan 161 ifindex 1

! IPv6:
! IPMS:
! AAA:
aaa authentication default "local"
aaa authentication console "local"
aaa authentication http "local"


! NTP:
ntp server clock2.ovcirrus.com
ntp server clock0.ovcirrus.com
ntp server clock1.ovcirrus.com
ntp server clock3.ovcirrus.com
ntp server 192.168.161.1 minpoll 4 prefer
ntp client admin-state enable

! QOS:
! Policy Manager:
! ERP:
! MVRP:
! LLDP:
! UDLD:
! Session Manager:
session cli timeout 30
session ftp timeout 30
session http timeout 30
session prompt default "Independant_2 ->"

! Web:
! Trap Manager:
! Health Monitor:
! System Service:
system timezone EET

! SNMP:
! IP Route Manager:
ip static-route 0.0.0.0/0 gateway 192.168.161.1 metric 1

! VRRP:
! RIP:
! OSPF:
! RIPng:
! OSPF3:
! LAN Power:
! DHCPv6 Relay:
! DHCPv6 Snooping:
! Virtual Chassis Split Protection:
! DHCP Snooping:
! Loopback Detection:
! OVC:
! IP DHCP RELAY:
! LOOPBACK TEST:
! MGMT AGENT:

[Cristek]

adding this should be enough:

-> vlan 20 name APs
-> vlan 21 name Guest
-> vlan 22 name Corporate

-> unp profile 'defaultWLANProfile' map vlan 20
-> unp classification lldp med-endpoint access-point profile1 'defaultWLANProfile'

this last command is already a default so you won't see it on your config
you already have ap-mode enabled on your template so any VLAN tags will be accepted
simply add SSIDs and tag them in the right VLAN (21 or 22)

[element1064]

Good day

What will be the reason for SIP phones working perfectly the whole day and the next morning the phones are down and the switch are putting the Voice VLAN 869 in block status and the phone is then not registered

Independant_1 -> show unp user
User
Port Username Mac address IP Vlan Profile Type Status
-------+--------------------+-----------------+---------------+----+--------------------------------+------------+-----------
1/1/3 00:17:c8:b9:09:37 00:17:c8:b9:09:37 10.0.0.23 10 Data-10 Bridge Active
1/1/4 18:66:da:31:f8:34 18:66:da:31:f8:34 10.0.1.138 10 Data-10 Bridge Active
1/1/4 24:9a:d8:93:c8:3f 24:9a:d8:93:c8:3f 192.168.105.50 869 Voice-869 Bridge Active
1/1/5 18:66:da:32:3d:5f 18:66:da:32:3d:5f 10.0.1.136 10 Data-10 Bridge Active
1/1/5 24:9a:d8:95:fc:90 24:9a:d8:95:fc:90 192.168.105.139 869 Voice-869 Bridge Active
1/1/6 24:9a:d8:93:d2:bf 24:9a:d8:93:d2:bf 192.168.105.132 869 Voice-869 Bridge Active
1/1/7 24:9a:d8:93:c8:4a 24:9a:d8:93:c8:4a 192.168.105.22 869 Voice-869 Bridge Active
1/1/7 54:bf:64:8b:b9:dc 54:bf:64:8b:b9:dc 10.0.1.195 10 Data-10 Bridge Active
1/1/8 d8:9e:f3:8a:f0:42 d8:9e:f3:8a:f0:42 10.0.2.19 10 Data-10 Bridge Active
1/1/10 24:9a:d8:93:d0:e8 24:9a:d8:93:d0:e8 192.168.105.26 869 Voice-869 Bridge Active
1/1/10 6c:4b:90:6a:b8:c8 6c:4b:90:6a:b8:c8 10.0.1.178 10 Data-10 Bridge Active
1/1/11 24:9a:d8:93:d2:70 24:9a:d8:93:d2:70 192.168.105.135 869 Voice-869 Bridge Active
1/1/11 e4:b9:7a:f0:f2:21 e4:b9:7a:f0:f2:21 10.0.1.219 10 Data-10 Bridge Active
1/1/12 24:9a:d8:91:d4:cb 24:9a:d8:91:d4:cb 192.168.105.38 869 - Bridge Block
1/1/12 b8:85:84:9e:22:b3 b8:85:84:9e:22:b3 10.0.1.160 10 Data-10 Bridge Active
1/1/13 90:2b:34:90:61:23 90:2b:34:90:61:23 10.0.1.198 10 Data-10 Bridge Active
1/1/14 00:4e:01:9d:58:e9 00:4e:01:9d:58:e9 10.0.1.89 10 Data-10 Bridge Active
1/1/15 24:9a:d8:95:fd:4d 24:9a:d8:95:fd:4d 192.168.105.20 869 Voice-869 Bridge Active
1/1/15 6c:4b:90:1d:90:fb 6c:4b:90:1d:90:fb 10.0.1.87 10 Data-10 Bridge Active
1/1/16 24:9a:d8:95:f9:41 24:9a:d8:95:f9:41 192.168.105.136 869 Voice-869 Bridge Active
1/1/16 d8:9e:f3:41:d9:55 d8:9e:f3:41:d9:55 10.0.1.91 10 Data-10 Bridge Active
1/1/17 00:80:91:da:67:6a 00:80:91:da:67:6a 10.0.0.18 10 Data-10 Bridge Active
1/1/18 24:9a:d8:91:db:50 24:9a:d8:91:db:50 192.168.105.152 869 Voice-869 Bridge Active
1/1/18 60:18:95:68:95:b0 60:18:95:68:95:b0 10.0.2.16 10 Data-10 Bridge Active
1/1/19 60:22:32:86:fb:37 60:22:32:86:fb:37 10.0.100.10 100 defaultWLANProfile Bridge Active
1/1/19 72:37:82:a840 72:37:82:a840 10.0.1.251 10 Data-10 Bridge Active
1/1/19 ca:a1:c9:53:f3:2b ca:a1:c9:53:f3:2b 10.0.1.250 10 Data-10 Bridge Active
1/1/19 f4:46:37:eb:38:4a f4:46:37:eb:38:4a 10.0.2.13 10 Data-10 Bridge Active
1/1/20 24:9a:d8:91:d9:82 24:9a:d8:91:d9:82 192.168.105.86 869 Voice-869 Bridge Active
1/1/20 d8:9e:f3:7b:79:46 d8:9e:f3:7b:79:46 10.0.1.212 10 Data-10 Bridge Active
1/1/21 00:23:24:53:c1:76 00:23:24:53:c1:76 10.0.1.216 10 Data-10 Bridge Active
1/1/22 24:9a:d8:93:c8:33 24:9a:d8:93:c8:33 192.168.105.25 869 - Bridge Block
1/1/22 6c:4b:90:0a:40:b0 6c:4b:90:0a:40:b0 10.0.1.114 10 Data-10 Bridge Active
1/1/23 00:23:24:60:7b:d6 00:23:24:60:7b:d6 10.0.1.144 10 Data-10 Bridge Active
1/1/23 24:9a:d8:93:d1:bb 24:9a:d8:93:d1:bb 192.168.105.24 869 - Bridge Block
1/1/26 24:9a:d8:91:db:33 24:9a:d8:91:db:33 192.168.105.36 10 Data-10 Bridge Active
1/1/26 24:9a:d8:91:db:33 24:9a:d8:91:db:33 192.168.105.36 869 Voice-869 Bridge Active
1/1/26 6c:4b:90:6d:38:76 6c:4b:90:6d:38:76 10.0.1.191 10 Data-10 Bridge Active
1/1/41 24:9a:d8:db:e3:2b 24:9a:d8:db:e3:2b 192.168.105.133 869 Voice-869 Bridge Active
1/1/42 24:9a:d8:91:c8:9e 24:9a:d8:91:c8:9e 192.168.105.48 869 Voice-869 Bridge Active
1/1/42 e4:b9:7a:f1:d4:e2 e4:b9:7a:f1:d4:e2 10.0.2.10 10 Data-10 Bridge Active
1/1/43 60:22:32:86:ef:df 60:22:32:86:ef:df 10.0.100.9 100 defaultWLANProfile Bridge Active
1/1/43 aa:cc:ae:19:f9:2c aa:cc:ae:19:f9:2c 10.0.1.130 10 Data-10 Bridge Active
1/1/44 60:22:32:87:17:6d 60:22:32:87:17:6d 10.0.100.6 100 defaultWLANProfile Bridge Active

[silvio]

I understand that at "show unp user" all is okay.
But a "show vlan members port x/x/x" the vlan is blocked? Only the voice-vlan or both?
What about "show spantree port x/x/x"? Do you use perVlan or flat? Often this occures in flat stp.

[element1064]

hi

Thanks for the reply, what I pasted was "show unp user" and there can be seen that Voice VLAN 869 gets "Blocked" and only the Voice VLAN, so the phones stops working but PC's are still working and the switches then needs to be rebooted so I do not know if its something in my config. The Spantree mode is per VLAN as can be seen below

1/1/23 00:23:24:60:7b:d6 00:23:24:60:7b:d6 10.0.1.144 10 Data-10 Bridge Active
1/1/23 24:9a:d8:93:d1:bb 24:9a:d8:93:d1:bb 192.168.105.24 869 - Bridge Block

Independant_2 -> show spantree mode
Spanning Tree Global Parameters
Current Running Mode : Per VLAN,
Current Protocol : N/A (Per VLAN),
Path Cost Mode : AUTO,
Auto Vlan Containment : N/A
Cisco PVST+ mode : Disabled
Vlan Consistency check: Disabled

[silvio]

Please check the output of the following commands during the issue and compare it with the "normal" output:

Code: Select all

show unp user details port 1/1/23
show spantree ports active
show vlan members port 1/1/23
show violation

I see that only one port/phone is affected. All the others in the same vlan are working. Correct? Than the settings in that phone are maybe the reason. I am not sure what are possible reasons for blocking after 24h. Is this the same type of phone like the others?

[element1064]

This was actually after a reset, before the reset it was all the ports an phone was connected to, its also not only 1 switch doing this, its like 7 switches doing exactly the same

This is very frustrating lol

[Cristek]

Can you share your config by any chance?
I have an SR logged with UNP issues in a 2260 but in my case it's about tagged traffic over Stellar APs.
They say they have identified the issue and are working on a fix but I'm now wondering if you have a similar type of config...

[element1064]

hi Please find config snapshot below

Independant_1 -> show configuration snapshot all
! Chassis:
system name "Maytex_Lansdown"
system location "Independant_1"

! Configuration:
configuration error-file-limit 2

! Capability Manager:
! Virtual Flow Control:
! Interface:
! Port_Manager:
! Link Aggregate:
! VLAN:
vlan 1 admin-state enable
vlan 10 admin-state enable
vlan 10 name "Data-10"
vlan 100 admin-state enable
vlan 100 name "Maytex_WLAN"
vlan 161 admin-state enable
vlan 161 name "Management-161"
vlan 869 admin-state enable
vlan 869 name "Voice-869"
vlan 161 members port 1/1/49-52 untagged
vlan 10 members port 1/1/49-52 tagged
vlan 100 members port 1/1/49-52 tagged
vlan 869 members port 1/1/49-52 tagged

! Spanning Tree:
spantree vlan 1 admin-state enable
spantree vlan 10 admin-state enable
spantree vlan 100 admin-state enable
spantree vlan 161 admin-state enable
spantree vlan 869 admin-state enable

! DA-UNP:
unp profile "Data-10"
unp profile "Voice-869"
unp profile "defaultWLANProfil"
unp profile "defaultWLANProfile"
unp profile "Data-10" map vlan 10
unp profile "Voice-869" map vlan 869
unp profile "defaultWLANProfile" map vlan 100
unp port-template DataTemplate direction both default-profile "Data-10" classification ap-mode admin-state enable
unp port 1/1/1-48 port-type bridge
unp port 1/1/1-48 port-template DataTemplate
unp classification lldp med-endpoint ip-phone profile1 "Voice-869"

! Bridging:
! Port Mirroring:
! Port Mapping:
! IP:
ip interface "Management-161" address 192.168.161.6 mask 255.255.255.0 vlan 161 ifindex 1

! IPv6:
! IPMS:
! AAA:
aaa authentication default "local"
aaa authentication console "local"
aaa authentication ftp "local"
aaa authentication http "local"
aaa authentication ssh "local"


! NTP:
ntp server clock0.ovcirrus.com
ntp server clock2.ovcirrus.com
ntp server clock1.ovcirrus.com
ntp server clock3.ovcirrus.com
ntp server 192.168.161.1 minpoll 4 prefer
ntp client admin-state enable

! QOS:
! Policy Manager:
! ERP:
! MVRP:
! LLDP:
lldp network-policy 1 application voice vlan 869 l2-priority 5 dscp 46
lldp nearest-bridge chassis tlv med network-policy enable
lldp chassis med network-policy 1

! UDLD:
! Session Manager:
session cli timeout 30
session ftp timeout 30
session http timeout 30
session prompt default "Independant_1 ->"

! Web:
! Trap Manager:
! Health Monitor:
! System Service:
system timezone SAST

! SNMP:
! IP Route Manager:
ip static-route 0.0.0.0/0 gateway 192.168.161.1 metric 1

! VRRP:
! RIP:
! OSPF:
! RIPng:
! OSPF3:
! LAN Power:
! DHCPv6 Relay:
! DHCPv6 Snooping:
! Virtual Chassis Split Protection:
! DHCP Snooping:
! DHCP Server:
! Loopback Detection:
! OVC:
! IP DHCP RELAY:
! LOOPBACK TEST:
! MGMT AGENT:

[element1064]

Please check the output of the following commands during the issue and compare it with the "normal" output:

Code: Select all

show unp user details port 1/1/23
show spantree ports active
show vlan members port 1/1/23
show violation

I see that only one port/phone is affected. All the others in the same vlan are working. Correct? Than the settings in that phone are maybe the reason. I am not sure what are possible reasons for blocking after 24h. Is this the same type of phone like the others?

I have this issue on both 2260 and 2360 as this customer has 13 ALE switches, below can be seen that I have this issue on port 1/1/20 now

1/1/20 24:9a:d8:91:d9:82 24:9a:d8:91:d9:82 192.168.105.62 869 - Bridge Block
1/1/20 d8:9e:f3:7b:79:46 d8:9e:f3:7b:79:46 10.0.1.212 10 Data-10 Bridge Active

Below are a screenshot of the commands that you said I must enter on a working and non-working port as well as a screenshot of the config, please advise if you see anything wrong with the config, thanks for you reply

Port Having the issue!!!!!!

Independant_1 -> show unp user details port 1/1/20
Port: 1/1/20
MAC-Address: 24:9a:d8:91:d9:82
SAP = -,
Access Timestamp = 07/25/2024 13:12:17,
User Name = 24:9a:d8:91:d9:82,
IP-Address = 192.168.105.62,
Vlan = 869,
Authentication Type = -,
Authentication Status = -,
Authentication Failure Reason = -,
Authentication Retry Count = 0,
Authentication Server IP Used = -,
Authentication Server Used = -,
Server Reply-Message = -,
Profile = -,
Profile Source = Default UNP - Block,
Profile From Auth Server = -,
Session Timeout = -,
Classification Profile Rule = -,
Role = -,
Role Source = -,
User Role Rule = -,
Restricted Access = -,
Location Policy Status = -,
Time Policy Status = -,
QMR Status = -,
Redirect Url = -,
SIP Call Type = Not in a call,
SIP Media Type = None,
Applications = None,
Encap Value = 869,
Rule ID = 32,
Port: 1/1/20
MAC-Address: d8:9e:f3:7b:79:46
SAP = -,
Access Timestamp = 07/26/2024 14:45:25,
User Name = d8:9e:f3:7b:79:46,
IP-Address = 10.0.1.212,
Vlan = 10,
Authentication Type = -,
Authentication Status = -,
Authentication Failure Reason = -,
Authentication Retry Count = 0,
Authentication Server IP Used = -,
Authentication Server Used = -,
Server Reply-Message = -,
Profile = Data-10,
Profile Source = No Auth - Default UNP,
Profile From Auth Server = -,
Session Timeout = -,
Classification Profile Rule = -,
Role = -,
Role Source = -,
User Role Rule = -,
Restricted Access = No,
Location Policy Status = -,
Time Policy Status = -,
QMR Status = -,
Redirect Url = -,
SIP Call Type = Not in a call,
SIP Media Type = None,
Applications = None,
Encap Value = -,
Rule ID = 20,

Total users : 2

Independant_1 ->
Independant_1 -> show spantree ports active
Vlan Port Oper Status Path Cost Role Note
-----+-------+------------+---------+-------+------
10 1/1/49 FORW 4 ROOT
100 1/1/49 FORW 4 ROOT
161 1/1/49 FORW 4 ROOT
869 1/1/49 FORW 4 ROOT

Independant_1 -> show vlan members port 1/1/20
vlan type status
--------+-----------+---------------
1 default forwarding
10 unpUntag forwarding
869 unpQtag forwarding

Independant_1 -> show vioviolation violation-recovery-configuration
Independant_1 -> show violation
* = Link Agg ID
LAG ID/ Recovery Recovery
Port Source Action Reason WTR Time Max/Remain
----------+----------+------------------+---------------+-----+------------+--------------

Independant_1 ->

Port working and not having the issue

Independant_1 -> show unp user details port 1/1/23
Port: 1/1/23
MAC-Address: 00:23:24:60:7b:d6
SAP = -,
Access Timestamp = 07/26/2024 14:44:37,
User Name = 00:23:24:60:7b:d6,
IP-Address = 10.0.1.177,
Vlan = 10,
Authentication Type = -,
Authentication Status = -,
Authentication Failure Reason = -,
Authentication Retry Count = 0,
Authentication Server IP Used = -,
Authentication Server Used = -,
Server Reply-Message = -,
Profile = Data-10,
Profile Source = No Auth - Default UNP,
Profile From Auth Server = -,
Session Timeout = -,
Classification Profile Rule = -,
Role = -,
Role Source = -,
User Role Rule = -,
Restricted Access = No,
Location Policy Status = -,
Time Policy Status = -,
QMR Status = -,
Redirect Url = -,
SIP Call Type = Not in a call,
SIP Media Type = None,
Applications = None,
Encap Value = -,
Rule ID = 34,
Port: 1/1/23
MAC-Address: 24:9a:d8:93:d1:bb
SAP = -,
Access Timestamp = 07/23/2024 20:25:03,
User Name = 24:9a:d8:93:d1:bb,
IP-Address = 192.168.105.60,
Vlan = 869,
Authentication Type = -,
Authentication Status = -,
Authentication Failure Reason = -,
Authentication Retry Count = 0,
Authentication Server IP Used = -,
Authentication Server Used = -,
Server Reply-Message = -,
Profile = Voice-869,
Profile Source = Tag LLDP Rule UNP,
Profile From Auth Server = -,
Session Timeout = -,
Classification Profile Rule = -,
Role = -,
Role Source = -,
User Role Rule = -,
Restricted Access = No,
Location Policy Status = -,
Time Policy Status = -,
QMR Status = -,
Redirect Url = -,
SIP Call Type = Not in a call,
SIP Media Type = None,
Applications = None,
Encap Value = 869,
Rule ID = 23,

Total users : 2





Independant_1 -> show configuration snapshot all
! Chassis:
system name "Maytex_Lansdown"
system location "Independant_1"

! Configuration:
configuration error-file-limit 2

! Capability Manager:
! Virtual Flow Control:
! Interface:
! Port_Manager:
! Link Aggregate:
! VLAN:
vlan 1 admin-state enable
vlan 10 admin-state enable
vlan 10 name "Data-10"
vlan 100 admin-state enable
vlan 100 name "Maytex_WLAN"
vlan 161 admin-state enable
vlan 161 name "Management-161"
vlan 869 admin-state enable
vlan 869 name "Voice-869"
vlan 161 members port 1/1/49-52 untagged
vlan 10 members port 1/1/49-52 tagged
vlan 100 members port 1/1/49-52 tagged
vlan 869 members port 1/1/49-52 tagged

! Spanning Tree:
spantree vlan 1 admin-state enable
spantree vlan 10 admin-state enable
spantree vlan 100 admin-state enable
spantree vlan 161 admin-state enable
spantree vlan 869 admin-state enable

! DA-UNP:
unp profile "Data-10"
unp profile "Voice-869"
unp profile "defaultWLANProfil"
unp profile "defaultWLANProfile"
unp profile "Data-10" map vlan 10
unp profile "Voice-869" map vlan 869
unp profile "defaultWLANProfile" map vlan 100
unp port-template DataTemplate direction both default-profile "Data-10" classification ap-mode admin-state enable
unp port 1/1/1-48 port-type bridge
unp port 1/1/1-48 port-template DataTemplate
unp classification lldp med-endpoint ip-phone profile1 "Voice-869"

! Bridging:
! Port Mirroring:
! Port Mapping:
! IP:
ip interface "Management-161" address 192.168.161.6 mask 255.255.255.0 vlan 161 ifindex 1

! IPv6:
! IPMS:
! AAA:
aaa authentication default "local"
aaa authentication console "local"
aaa authentication ftp "local"
aaa authentication http "local"
aaa authentication ssh "local"


! NTP:
ntp server clock0.ovcirrus.com
ntp server clock2.ovcirrus.com
ntp server clock1.ovcirrus.com
ntp server clock3.ovcirrus.com
ntp server 192.168.161.1 minpoll 4 prefer
ntp client admin-state enable

! QOS:
! Policy Manager:
! ERP:
! MVRP:
! LLDP:
lldp network-policy 1 application voice vlan 869 l2-priority 5 dscp 46
lldp nearest-bridge chassis tlv med network-policy enable
lldp chassis med network-policy 1

! UDLD:
! Session Manager:
session cli timeout 30
session ftp timeout 30
session http timeout 30
session prompt default "Independant_1 ->"

! Web:
! Trap Manager:
! Health Monitor:
! System Service:
system timezone SAST

! SNMP:
! IP Route Manager:
ip static-route 0.0.0.0/0 gateway 192.168.161.1 metric 1

! VRRP:
! RIP:
! OSPF:
! RIPng:
! OSPF3:
! LAN Power:
! DHCPv6 Relay:
! DHCPv6 Snooping:
! Virtual Chassis Split Protection:
! DHCP Snooping:
! DHCP Server:
! Loopback Detection:
! OVC:
! IP DHCP RELAY:
! LOOPBACK TEST:
! MGMT AGENT: