Configuring multiple SSIDs and VLANs on a Cisco Aironet 1100

Thanks, that's very helpful. For the HTTP/HTTPS traffic, I can just pass the traffic from the guest SSID's VLAN to the same VLAN on the core switch, then? We're not actually doing anything with VLANs on the secondary switch that the wireless device is plugged into besides just telling it to pass the VLAN data along to the core switch via trunking, correct? And for VLAN 1, we're basically just leaving that alone after specifically assigning it to the existing SSID.

For the DHCP, I'm assuming I should just be able to pass BOOTP between the wireless clients and the server without too much trouble, correct?

Sorry for so many follow-ups. I just want to be clear before I accept the solution.

To answer your first question, yes, you will create the same vlan on your core as you did on your access point. Trunking will get you there. You just need to make sure that the port on the switch that the access points are plugged into are set up for trunking, nothing else needs done to the switch. They'll pass the traffic back to the core where the vlan is configured.

It is probably alread configured for security on vlan1 however if not, you'll need to make sure. Once you assing the vlan to the ESSID, then your security takes effect. So if you have a default configuration on the access point, you shouldn't have to do anything else with it because your security should already be configured correctly. Just look in the web interface at the access points configuration under the ESSID and you should see if vlan1 is assigned. If all is well, just leave it along and move on to configuring the next vlan and ESSID.

As for DHCP, just put a help address on the vlan interface that your using for the guest wireless pointing to your dhcp server so that the guest can get an IP address. When you configure the access list on the interface of the guest vlan only allowing certain traffic, make sure you configure it to pass DHCP/BootP traffic.

Great, we'll get this implemented and I'll accept after it's all in. Thanks again.

Good luck and if you need help with any configurations, let me know.

Alright, I have the second SSID turned on and accepting connections, but it doesn't seem to be passing the DHCP requests. I've gone back down to the bare setup, no access lists on the port, no security just to be sure and it still won't give guests their IP addresses. I've tried helper addresses on every interface I can think of, still no dice. Here are a few relevent snippets from our devices.

Access point:
interface Dot11Radio0.10
 encapsulation dot1Q 10
 ip helper-address x.x.x.x
 no ip route-cache
 bridge-group 10
 bridge-group 10 subscriber-loop-control
 bridge-group 10 block-unknown-source
 no bridge-group 10 source-learning
 no bridge-group 10 unicast-flooding
 bridge-group 10 spanning-disabled
 
interface FastEthernet0.10
 encapsulation dot1Q 10
 ip helper-address x.x.x.x
 no ip route-cache
 bridge-group 10
 no bridge-group 10 source-learning
 bridge-group 10 spanning-disabled
 
interface Dot11Radio0
 no ip address
 no ip route-cache
 mbssid
 ip helper-address x.x.x.x
 
Dell PoE Switch, Aironets connect in here:
interface range ethernet e(19,21)
switchport mode trunk
dot1x system-auth-control
interface range ethernet e(19,21)
dot1x guest-vlan enable
 
Cisco Catalyst, core device:
interface GigabitEthernet1/0/10
 description Dell 3548P
 switchport trunk encapsulation dot1q
 switchport mode trunk
 
interface Vlan10
 description Guest Wireless
 no ip address
 ip helper-address 10.1.13.251
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:

I've been looking around at other people's examples on the web quite a bit and I'm leaning towards the PowerConnect's trunking being the problem. Could be wrong, but that's my guess. I get the feeling it's not allowing VLAN 10's traffic over to the Cisco properly. Not sure what's missing, though.

Maybe, maybe not. You don't need to put helper addresses on ANY of the access points interfaces. The access point bridges (trunks) to the switch to VLAN 10, so that's where the helper address should be. It should be a routable vlan with an IP address on it on the switch and should have the helper address on it configured to point to your DHCP server.

So right now on my core switch I have a VLAN 10 created with 10.1.17.1 assigned, which I want to be the gateway for this guest DHCP pool. Right now the VLAN isn't assigned to any ports, which I assume it doesn't need to be, correct? I have the 10.1.17.0 scope set up alongside our old scopes on the Windows DHCP server.

Catalyst:
interface Vlan10
description Guest Wireless
ip address 10.1.17.1 255.255.255.0
ip helper-address 10.1.13.251

Trunking is still set up on the PowerConnect just like earlier. The original SSID is still handing out addressses from the 10.1.13.0 range, our internal range, but no luck yet with the guest access. Any other ideas?

Do a "show int' on the vlan on the catalyst and a "show run int" on the vlan and post them here.

Here you go.

CORESW#sh int vlan10
Vlan10 is down, line protocol is down
  Hardware is EtherSVI, address is 0023.0533.c046 (bia 0023.0533.c046)
  Description: Guest Wireless
  Internet address is 10.1.17.1/24
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output never, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     0 packets input, 0 bytes, 0 no buffer
     Received 0 broadcasts (0 IP multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 packets output, 0 bytes, 0 underruns
     0 output errors, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out
 
CORESW#sh run int vlan10
Building configuration...
 
Current configuration : 119 bytes
!
interface Vlan10
 description Guest Wireless
 ip address 10.1.17.1 255.255.255.0
 ip helper-address 10.1.13.251
end
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34: