Port type between Access Point MR and Switch Access Cisco

[natuan]

Hello everybody,

Our office has over 100 clients and 4 APs MR33.

Our Topology:

(Meraki MX)  <----->  (Switch Access 2960 Cisco)  <----->  (AP MR33)

Meraki MX is the gateway + DHCP Server.

We have 4 VLANs:

- VLAN 10: Staff

- VLAN 20: Guest

- VLAN 30: Management

- VLAN 40: Partner

My question is when I configure port type between MR33 and C2960 is trunk. It worked, 4 SSIDs broadcasted and correctly VLANs assigned.

When I configure port type between MR33 and C2960 is access to Staff VLAN. It worked as well.

I have no idea why access ports still work. Please help me to understand it.

Thank you,

natuan

[rhbirkelund]

How is Client IP Assignment configured for the SSIDs under Wireless -> Access Control?

[natuan]

We use Bridge Mode for both situations.

[NolanHerring]

---

@natuan wrote:
We use Bridge Mode for both situations.

---

Can you show us an image example of how you have this configured for one of the SSIDs? Curious to check something.

[natuan]

For Staff WiFi, we use WPA2-Enterprise with radius and Bridge mode.

[NolanHerring]

are you tagging the VLAN when you have bridge-mode enabled?

[natuan]

I show config on another access switch 🙂
In fact, that AP is connecting to VLAN 10 - Staff with access port.
No VLAN tagging for Staff SSID and other SSIDs are Layer 3 roaming with a concentrator.

[natuan]

Hi,

Just make a simple test, change between Bridge mode and Layer 3 roaming with a concentrator for guest VLAN

When I use Bridge mode, user has the same IP with staff VLAN.
When I use Layer 3 roaming with a concentrator and conventrate traffic on VLAN guest, user has the guest IP.

My conclusion is L3 roaming with a concentrator can bypass access port.

[ww]

Thats normal because al traffic tunnels to you wlc/appliance. The switch does not know whats inside the tunnel packets. 

https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/SSID_Modes_for_Client_IP_Assignme...

[ww]

can you add the full config of the cisco switch port when configured for access.

[natuan]

The configuration:

interface GigabitEthernet0/3
switchport access vlan 30
switchport mode access
spanning-tree portfast edge
end

[ww]

you could check the vlans on the port.

#sh int G0/3 status

#sh vlan | i 0/3

it also works if you bounce the port?

[natuan]

oh I show config on another access switch. LOL

In fact, that AP is connecting to VLAN 10 - Staff with access port.