vSZ-D Tunnelling WLAN with VLAN Tag What i am missing

  • 1
  • Question
  • Updated 9 months ago
  • Answered
The problem is when i create WLAN and tagged it with DATA VLAN ID 234 , (i used Tunnel WLAN traffic to the controller) my client can't get IP address from DATA VLAN, try it with static IP address assignment, my device still can't ping my DATA VLAN Gateway
 I look around the configuration and still not working. What i am missing
Vsz-H version
Vsz-D version
AP-R700 Router Cisco DHCP-SERVER and Gateway


Virtual :
Vsz-D Data interface IP
MGMT interface IP Vsz-H
MGMT interface IP

all port Trunk.
My Topology
Photo of Lasha Chavleshvili

Lasha Chavleshvili

  • 10 Posts
  • 1 Reply Like

Posted 9 months ago

  • 1
Photo of Michael Brado

Michael Brado, Official Rep

  • 2570 Posts
  • 351 Reply Likes
Hi Lasha,

   I can see/understand your diagram, but it appears you are missing some things.

In VMware, you need to setup a new port group for the DataPlane.  You need to make this port
a trunk by allowing all VLANs.  Enable Promiscuous mode and then, since you are running a
vSwitch, you need to go to the vSZ-D Console, and configure the data interface to tag the data
VLAN for it.

The Client WLAN VLAN should be different than the data VLAN from the data interface.  You don't
want your client having access to that VLAN I'd assume.

To recap:

1 - Create new portgroup with All VLANs allowed and promiscuous mode accept in the security tab.
2 - Console to the vSZ-D and go to configure, interface data, VLAN 234 to tagthe data interface VLAN.
3 - Create a new VLAN for the clients and then configure that on the AP so thatthey get their IPs from there.  The vSZ-D data interface VLAN and theclient access VLAN should never be the same (not that they can't). 
4 - Ensure the switch port allows the newly created client VLAN.
5 - Ensure DHCP is set for the new VLAN, not VLAN 234 as that is the interfaceof the vSZ-D Data Interface.
6 - Ensure the AP can talk to the vSZ-D Data interface and the controlinterface.

For reference, from the AP to the vSZ-D Data Interface, by default, you should allow ports 23233 on both TCP and UDP.
From the AP to the control plane, you need port 22, 443, and any other port you may require for captive portals, see the firewall configuration guide on our support site under Best Practice Documents section.

I hope this helps.