Should I enable VLAN Configuration on 450i AP

Hi,

Can someone explain to me why should I enable VLAN configuration on a 450i PMP AP? what are the use cases? what is the benefit?

When I enable management VLAN for example VID 101, I can no longer directly access the AP from a laptop when I try that the AP boots on recovery mode and can only be managed via the default IP 169.254.1.1.  I have to connect it to a switch and connect my laptop to the same switch on the same VLAN 101 to access it again. This presents a challenge specially on the field if you're trying to re-align.

I noticed the same thing on the SM side specially if the SM is not associated with any AP.

Any thoughts?

Thanks.

Aomar.

Hi Aomar, the simple answer is that you should enable VLAN's on the PMP450 equipment if you want those VLAN's to exist/extend down to the PMP450 AP and SM.  Some users put customer's data on a different VLAN per region, per individual or per application type (i.e. VoIP traffic), but also want an internal management VLAN that is separate.

If you enable VLAN's and set a management ID, the GUI will only be accessible when accessing from that VLAN (or via the AP proxy).  This isn't too much of an issue for the AP since it should be on the network and reachable.  However, it presents a problem for SM's, especially during the install process, if your installers don't have a computer on the management VLAN.

I would recommend using our cnArcher App to install SM's (from out of the box).  That will allow you to access the SM and do the alignment, as well as, set the VLAN as a final step.  

Here are some resources that can help with the VLAN question:

http://community.cambiumnetworks.com/t5/PMP-Getting-Started/VLAN-Engineering-and-Design/m-p/39292/highlight/true#M46

http://community.cambiumnetworks.com/t5/PMP-Best-Practices-and-Examples/How-to-configure-PMP450-VLAN-tagging/m-p/51009/highlight/true#M19 

2 Likes

It appears Chris took care of your general question above. 

However, there IS a way to access the 450 radios after a port VID has been added if you are accessing locally from a laptop or PC... With everything connected up and your laptop NIC set to 169.254.1.x/24 and the port VID set on the SM, unplugging the SM from the PoE injector, then quickly plugging back in (Less than 3 seconds it seems) will bring you into the SM's recovery mode from a 169.254.1.1 web browser page. From there, you can select "Default Boot" to access the radio GUI again and make any necessary changes or view alignment as needed. 

Hope this helps!

Anthony.

2 Likes

Hi Chris,

Thank you for your answer, on our case as you might remember we used the VLAN configuration because we are using the radios as bridge to interconnect different location carying seperate VLANs and we do have a seperate VLAN for managment.

What I'm finding out is that when VLAN management is enabled if the AP is connected directly to a laptop even though I set up an IP on that same subnet as the AP's IP I can't manage it. The AP goes on a recovery mode and the only way to manage it is via 169.254.1.1 ( need to change my laptop IP to this subnet first) and I have to quickly select default mode to access it.

I find this a bit strange.

I guess the same thing will happen for the SM.

Thanks.

Aomar.

That's exactly what I'm finding out. I thought it was a bit strange but it seems like it's per desing.

Does it apply to the SM as well or can the SM be still managed via VID?

I'm not sure I 100% understand your question... But If I'm thinking on the same wavelength as you, you would manage the SM via your MGMT VLAN (Management VID in 450 radios) network, over the WLAN interface, and allow your customer to have the LAN port spit out tagged frames for them, if tagging is even necessary in the first place of course. Generally what most service provider network engineers do, is create a management network/VLAN for MGMT traffic to their depolyed devices, then allow one public IP per subscriber. This helps a-lot with gamers, as most will complain of a double NAT situation ultimately if the SM is performing NAT of it's own, diversely from your router.