Cannot Manage Cisco Aironet 1131AG from LAN via 2950

With regard to setting the encapsulation on the switchport, can you post the output from the following command:

sho int fa0/16 sw

OK, changed the native VLAN on the trunkport, can see from that output that it's showing encap as dot1q, so all good there.

Have made the change and I can now ping and browse to it from the server :)

I think that on the other AP's I've set the native VLAN as 98, so was getting there in some instances.... Now just to setup WPA2 Personal for one of the VLANs.

Name: Fa0/16
Switchport: Enabled
Administrative Mode: trunk
Operational Mode: down
Administrative Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 99 (infrastructure)
Voice VLAN: none
Administrative private-vlan host-association: none
Administrative private-vlan mapping: none
Administrative private-vlan trunk native VLAN: none
Administrative private-vlan trunk encapsulation: dot1q
Administrative private-vlan trunk normal VLANs: none
Administrative private-vlan trunk private VLANs: none
Operational private-vlan: none
Trunking VLANs Enabled: ALL
Pruning VLANs Enabled: 2-1001
Capture Mode Disabled
Capture VLANs Allowed: ALL
Protected: false
Appliance trust: none

Cool.  Glad it works :-)

If you need help with WPA give us a shout!

Well this bit looked like it should have been a breeze!

dot11 ssid TEDCO-INT
   vlan 100
   authentication open
   authentication key-management wpa version 1
   mobility network-id 100
   wpa-psk ascii 7 [password]

encryption vlan 100 mode ciphers tkip

Two Win7 laptops can't connect using WPA Personal and TKIP. Have tried AES as the cipher to no avail too.

You've assigned the TEDCO-INT SSID to VLAN100, but your config doesn't have an interface for VLAN100 (if the config is the same as above).
Can you post all your config from the AP, and make sure you have a VLAN100 on your switch - (I'm assuming you have :-)).

OK, sorry, had started to go round the other AP's to make the config changes and half of them had no Ethernet connections, faulty ports on the switch, time for new switches I think!

Here is the config from AP that this particular one needs to be on, I've removed it from the other AP.

Current configuration : 3691 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname reception-ap
!
enable secret 5 $1$s3mS$Ly6M0gaeY2F4evRXTxG9X1
!
no aaa new-model
!
!
dot11 vlan-name INFRA vlan 99
dot11 vlan-name TEDCO-INT vlan 100
!
dot11 ssid INFRA
   vlan 99
   authentication open
!
dot11 ssid TEDCO-INT
   vlan 100
   authentication open
   authentication key-management wpa
   mobility network-id 100
   wpa-psk ascii 7 [Password]
!
dot11 ssid TEDCO-PUBLIC
   vlan 98
   authentication open
   guest-mode
!
power inline negotiation prestandard source
!
!
username xxx password 7 xxxx
usernamexxx privilege 15 password 7 xxxx
!
bridge irb
!
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption vlan 100 mode ciphers aes-ccm
 !
 ssid INFRA
 !
 ssid TEDCO-INT
 !
 ssid TEDCO-PUBLIC
 !
 speed  basic-1.0 2.0 5.5 11.0 6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0
 station-role root
!
interface Dot11Radio0.98
 encapsulation dot1Q 98
 no ip route-cache
 bridge-group 98
 bridge-group 98 subscriber-loop-control
 bridge-group 98 block-unknown-source
 no bridge-group 98 source-learning
 no bridge-group 98 unicast-flooding
 bridge-group 98 spanning-disabled
!
interface Dot11Radio0.99
 encapsulation dot1Q 99 native
 no ip route-cache
 bridge-group 1
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface Dot11Radio0.100
 encapsulation dot1Q 100
 no ip route-cache
 bridge-group 100
 bridge-group 100 subscriber-loop-control
 bridge-group 100 block-unknown-source
 no bridge-group 100 source-learning
 no bridge-group 100 unicast-flooding
 bridge-group 100 spanning-disabled
!
interface Dot11Radio1
 no ip address
 no ip route-cache
 !
 encryption vlan 100 mode ciphers aes-ccm
 !
 ssid INFRA
 !
 ssid TEDCO-INT
 !
 ssid TEDCO-PUBLIC
 !
 no dfs band block
 speed  basic-6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0
 channel dfs
 station-role root
!
interface Dot11Radio1.98
 encapsulation dot1Q 98
 no ip route-cache
 bridge-group 98
 bridge-group 98 subscriber-loop-control
 bridge-group 98 block-unknown-source
 no bridge-group 98 source-learning
 no bridge-group 98 unicast-flooding
 bridge-group 98 spanning-disabled
!
interface Dot11Radio1.99
 encapsulation dot1Q 99 native
 no ip route-cache
 bridge-group 1
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
 bridge-group 1 spanning-disabled
!
interface Dot11Radio1.100
 encapsulation dot1Q 100
 no ip route-cache
 bridge-group 100
 bridge-group 100 subscriber-loop-control
 bridge-group 100 block-unknown-source
 no bridge-group 100 source-learning
 no bridge-group 100 unicast-flooding
 bridge-group 100 spanning-disabled
!
interface FastEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
!
interface FastEthernet0.98
 encapsulation dot1Q 98
 no ip route-cache
 bridge-group 98
 no bridge-group 98 source-learning
 bridge-group 98 spanning-disabled
!
interface FastEthernet0.99
 encapsulation dot1Q 99 native
 no ip route-cache
 bridge-group 1
 no bridge-group 1 source-learning
 bridge-group 1 spanning-disabled
!
interface FastEthernet0.100
 encapsulation dot1Q 100
 no ip route-cache
 bridge-group 100
 no bridge-group 100 source-learning
 bridge-group 100 spanning-disabled
!
interface BVI1
 ip address x x
 no ip route-cache
!
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
 login local
!
end

Ok, lets remove the mobility option to test...

Can you change your config to this:


dot11 ssid TEDCO-INT
   vlan 100
   authentication open
   authentication key-management wpa
   wpa-psk ascii 7 [Password]



Also can you enable terminal monitor and paste the output from the terminal when a client tries to connect?

Dude, just removing the mobility option did the trick :-)

Any idea what that is for?

Thanks for all your help!

No problem! :-)

The mobility option is for moving between cells/networks.  If you've got a flat network you won't need it.