Setting up Wireless AP's on Existing Cisco Network

Jake Pratt
Jake Pratt used Ask the Experts™
on
I have been deploying various wireless AP's in my network for years and years.  We have a Cisco network with at least 30 different subnets, and we use EIGRP as our dynamic routing protocol.  I have always wanted our AP's to act like a switch instead of a router.  So I have always disabled DHCP, assigned it a static LAN IP address, and plugged it into my network on one of its 1-4 switchports, and not using the "internet" port.  This goes for all my routers (varying Linksys/Cisco models, and even a couple old Netgears).

I have been realizing lately that once I get an AP build and sent out to the remote location (on a different subnet), I can usually no longer web into it.  I am in the middle of deploying an NPS server to do 802.1x authentication, and I'm realizing that the E2000 I'm using cannot ping or see the NPS server which is on a different subnet.  So, I'm sure I'm missing something.

On this E2000, I have disabled the SPI firewall, turned off NAT, enabled dynamic routing, etc.  But I can't ping devices on another subnet from the E2000.  I also can't ping www.google.com or other URL's from the E2000.  It will not resolve them.  (My DNS servers are on another subnet... same subnet as the NPS server).

As an example, this is what my network is setup like:
E2000 and computers in my test environment - 10.2.4.0 255.255.255.0
NPS and DNS servers - 10.2.2.0 255.255.255.0

If I look at the routing table on the E2000, it just has one route that looks like this:

Dest. LAN IP: 10.2.4.0
SN Mask: 255.255.255.0
Gateway: 0.0.0.0
Interface: LAN & Wireless

The EIGRP entry on my main Cisco 7204 gateway router looks like this:

router eigrp 7
redistribute static
network 10.2.0.0
no auto-summary

Is there something I'm missing on my wireless APs?  Do I need to configure my Cisco routers to use RIP in addition to EIGRP?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
SouljaSr.Net.Eng
Top Expert 2011

Commented:
Does the AP support EIGRP? Is the default gateway set on it? I would think the gateway would be 10.2.4.x which ever is the gateway address for that subnet.

Author

Commented:
The only option for dynamic routing on the AP (Linksys E2000) is RIP.  So I was wondering if if I went onto my Cisco gateway routers and added "redistribute RIP" to my eigrp router statements.

I don't think there is way to specify the default gateway on these Linksys routers for the LAN IP.  You can only specify an IP address and subnet mask for the LAN interface.  You can specify all your IP settings (DNS, Gateway, etc.) for the WAN interface.  But I haven't been using the WAN interface.  If I use the WAN interface, it doesn't allow my computers to get IP addressing from my Windows DHCP server.

It could be that I have been approaching these wireless AP's completely wrong from my environment, but that it the only way I've been able to get them to act as a switch, and pass through DHCP and routes.
SouljaSr.Net.Eng
Top Expert 2011

Commented:
I think you hit it on the head. You should not have been using these devices as AP's, but installed actual AP's. You could put DD-WRT or Tomato on them and they could be changed to AP's. That is an option.
CompTIA Security+

Learn the essential functions of CompTIA Security+, which establishes the core knowledge required of any cybersecurity role and leads professionals into intermediate-level cybersecurity jobs.

Author

Commented:
I'm a little confused.  What I've been installing are not actually AP's, they are technically wireless routers.  What kind of a device/setup do I need to be able to talk to my dynamic Cisco network with many different subnets?

If I need to install custom firmwares, like DD-WRT, I can certainly do that.
Sr.Net.Eng
Top Expert 2011
Commented:
That is what I am saying. Put another fireware type on them like DD-WRT and then you will be able to make them actual AP's instead of wireless routers. Then you will not have all the routing issues.

Author

Commented:
Ok, so I went onto my Cisco gateway router, and set it up to distribute RIP as well as EIGRP.  It looks like that fixed the routing issue.  It at least lets my wireless router see my NPS server, and allows it to be remotely managed.

If I ping www.google.com from the wireless router, it still says unknown host, because my wireless router doesn't have any DNS servers assigned.  But I don't care about that.  I'm sure that's something I could fix by installing a custom firmware.  But that will likely require me to be onsite to do that to all these other wireless routers.  I think the best solution will be to add RIP to all my gateway routers (or OSPF, or whatever the particular wireless router will support.)
SouljaSr.Net.Eng
Top Expert 2011

Commented:
Okay, I would have suggested redistributing, but I don't like building on top of bad design (no offense). If that works for you they by all means let it remain as it stands.
Top Expert 2014
Commented:
You don't need to change the firmware, or use RIP.  The router doesn't have a WAN IP address, so it doesn't have a default gateway.  Simply add a static route to it which points 0.0.0.0 / 0.0.0.0 to the default gateway for whatever subnet it is on.

Why make it more complex than it needs to be?  Adding RIP to your backbone routers is just more config, adds to the potential to mess up your routing, and adds more overhead.
SouljaSr.Net.Eng
Top Expert 2011

Commented:
The wireless man has spoken!  ;-)

Author

Commented:
Yeah, that sounds like a great idea.  I'm actually going to go try that right now.  I'll take RIP off my gateway, and throw in that static route.  I'll let you know.
Top Expert 2014

Commented:
Sorry guys :-P

Author

Commented:
Ok, one more question.  I just removed RIP from my gateway, and now I can't see the wireless router from other subnets (as expected).  However, while trying to create a static route for 0.0.0.0 / 0.0.0.0, it says in "Invalid static route".  I don't know if there's a special way to specify to route "everything" through my local gateway.  You can see my route and the error message in the attached screenshot.  You'll see that I blacked out my gateway, but the gateway I entered is the local gateway for the subnet that my wireless router is on.  Anything special with the Linksys routers?

Static Router Error

Author

Commented:
If I try to enter 0.0.0.0 as the destination LAN IP, as soon as I put a 0 in the first octec, and tab to the next octet, it throws an error and says "The value is out of range [1 - 223]".  So, it sounds like it won't let me use 0.0.0.0 as a valid destination IP.  There's got to be a way to add that route.
Top Expert 2014

Commented:
There shouldn't be a reason why the router won't allow a 0.0.0.0 route!

I've got a BEFSR41 I'm going to test with now.

Assuming you run a 10.x.y.z range inside your network you could add a 10.0.0.0 / 255.0.0.0 route instead of a 0.0.0.0 / 0.0.0.0.

Author

Commented:
I actually tried that already (the 10.0.0.0 / 255.0.0.0 route), and it said that was an invalid static route as well.
Top Expert 2014

Commented:
I've just added a route to 0.0.0.0 / 0.0.0.0 on my router and it works fine.

Can you show the complete routing table?

Author

Commented:
The routing table only has one route in it:
Destination LAN IP: 10.x.x.0 (sanitized the middle two octets)
Subnet Mask: 255.255.255.0
Gateway: 0.0.0.0

So its destination is the entire class C network that the wireless router is on.  I'm not sure how it's handling the gateway.  And if I try to add my own static route with a 0.0.0.0 Gateway, it gives me the same error about "The value is out of range [1-223]".  Interesting.
Top Expert 2014

Commented:
Hmmm that's really odd!

What model is the router?

Author

Commented:
Linksys E2000.
Top Expert 2014

Commented:
Ok, with NAT enabled, dynamic routing is automatically enabled.

Can you try re-enabling NAT, disable dynamic routing then try and add the route?

Author

Commented:
I had already tried it with dynamic routing on and off, and it failed each time.  I just tried it again with NAT enabled, and it still says invalid static route.  It also still tells me that 0 for the first octet is invalid.
Top Expert 2014

Commented:
That's crazy!

Have you put the Management IP address on the LAN instead of the WAN?  The WAN should be set to obtain an IP automatically.

Author

Commented:
Yes, that is the way I have it setup.  The WAN is set to DHCP (but it doesn't have an address, because it's not plugged into anything).  Then I have the management IP assigned on the LAN, and I have DHCP on the LAN disabled).

Author

Commented:
I just spent over an hour with Linksys support, but I'm no closer to fixing the problem than I was before.  You know how they are.  I spent 30 minutes talking to the level 1 tech, and just trying to explain very basic networking concepts to her.  She had NO idea what I was talking about or what I was trying to do.  And she just kept saying "these are for home use, and not supported in a business environment".  Level 2 support didn't give me any info, and gave me some other number for Cisco routing/switching support.  And of course, they said "we don't support the home wireless routers".

I tried the same thing on an E1000, and a very old Wireless-G Broadband Router.  I don't have any WRT56G's in this office that I can try it on.  But it kind of looks like they may not be able to do that.  RIP may be the way I have to go to get my routes working.  Kind of frustrating.
Top Expert 2014

Commented:
You may be right.  I don't understand why the BEFSR41 lets me do it, but a newer, more capable router won't.  Maybe it's Cisco's way of forcing you to buy a proper Cisco router?!

RIP may be the only way then, but that's a big downer on resources on your backbone kit just to get the router to be able to talk on the network, and as I said earlier it just improves the chances of a problem later.

Just out of interest, is there a reason why you used the E2000 instead of a normal AP?
SouljaSr.Net.Eng
Top Expert 2011

Commented:
"is there a reason why you used the E2000 instead of a normal AP"

That was my question too?

Author

Commented:
I've basically just been buying routers instead of AP's because that's what I've always done.  When I first started installing them, about 9 years ago, it seemed like routers were cheaper, and had more functionality.

Even now, everything I read basically says that a router will do everything an AP will do, and then some.  So I guess I just haven't seen any compelling argument to get an AP over a router.  Perhaps I've been getting some bad information.

Author

Commented:
There are also some situations (in smaller 1 or 2 person offices) where I use the wireless router as a switch too, and don't have to buy an additional piece of hardware.
Top Expert 2014

Commented:
They will do more than an AP for sure, but only in certain deployments.  I guess now you've seen the limitation.  If you used an AP you wouldn't have this problem as it would simply have a default gateway.

Soulja's gonna love this now... but your best bet might actually be to flash one of your routers with DD-WRT and put it in AP mode.  Don't tell him I said that though ;-)
SouljaSr.Net.Eng
Top Expert 2011

Commented:
lol

Author

Commented:
Thanks for both your help.  I really appreciate it.

I tried installing DD-WRT on my E2000 on Friday, but I had a lot of issues with it.  I got it installed, and started to configure my device, but every time I changed a setting and saved it, my browser window would just go white.  After a couple minutes, I would go back to the IP address and the settings wouldn't have saved.  I had a little better luck with IE over Firefox, but it was still pretty hit and miss.  With everything I tried I ended up doing a 30/30/30 reset about 15 times to try and get my settings correct.

Looking around at the settings too, I didn't see much that looked different from the default Linksys settings.  There were some that looked useful, but honestly I couldn't really get it up and working on my network.  I didn't spend more than a couple hours messing around with it, but it only takes me about 5-10 minutes to get a Linksys up on the network with the default image.

After messing around with it for a while, and being a little disenchanted, I decided to revert it to the Linksys image.  I tried repeatedly through the web portal, and soon realized that reverting is a HUGE pain in the butt.  It took me several hours to figure out how to get it back, and it involved me telnetting into the router, erasing Linux (breaking DD-WRT), doing a hard reset, then perfectly timing a TFTP transfer of the Linksys image to the router, and then doing one more hard reset.

After the headache of trying to use DD-WRT, it seems much easier to me to add 3 lines of code to my gateway router and enable RIP on my network.  I'll probably switch and buy AP's from here on out, but I think for now, I might just stick with using RIP.  I'll probably continue to play around with some of these different options, and see what works best.  But right now, that's looking like my easiest/best solution.
A little additional summary information:

The RIP worked great for my E2000's and my WRT54G's, which is easier than using DD-WRT.  However, RIP would NOT work on my E1000.  I ended up throwing DD-WRT on it, and then I was able to create the static route that way.

So, I think we've come up with basically 3 solutions to this problem:
1. Load DD-WRT, and create static routes
2. Use RIP, and add RIP to my Cisco gateway router
3. Get AP's (I'll be doing this moving forward, but I'm not going to replace all my routers because of cost).

Thanks for both of your help.

Author

Commented:
Thanks for your help.  I also marked my summary comment as a solution, since it provides a little more detail to my solution.  I really appreciate your time!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial