Cisco Cisco Access Registrar 4.2 Especificações descarregar pdf (Página 489)

11-7

Cisco Wireless LAN Controller Configuration Guide

OL-13826-01

Chapter 11 Configuring Mobility GroupsWireless Device Access

Overview of Mobility Groups

Note Clients may roam between access points in different mobility groups, provided they can hear them.

However, their session information is not carried between controllers in different mobility groups.

Determining When to Include Controllers in a Mobility Group

If it is possible for a wireless client in your network to roam from an access point joined to one controller

to an access point joined to another controller, both controllers should be in the same mobility group.

Using Mobility Groups with NAT Devices

In controller software releases prior to 4.2, mobility between controllers in the same mobility group does

not work if one of the controllers is behind a network address translation (NAT) device. This behavior

creates a problem for the guest anchor feature where one controller is expected to be outside the firewall.

Mobility message payloads carry IP address information about the source controller. This IP address is

validated with the source IP address of the IP header. This behavior poses a problem when a NAT device

is introduced in the network because it changes the source IP address in the IP header. Hence, in the guest

WLAN feature, any mobility packet being routed through a NAT device is dropped because of the IP

address mismatch.

In controller software release 4.2, the mobility group lookup is changed to use the MAC address of the

source controller. Because the source IP address is changed due to the mapping in the NAT device, the

mobility group database is searched before a reply is sent to get the IP address of the requesting

controller. This is done using the MAC address of the requesting controller.

When configuring the mobility group in a network where NAT is enabled, enter the IP address sent to

the controller from the NAT device rather than the controller’s management interface IP address. Also,

make sure that the following ports are open on the firewall if you are using a firewall such as pix:

• UDP 16666 for tunnel control traffic

• UDP 16667 for encrypted traffic

• IP protocol 97 for user data traffic

• UDP 161 and 162 for SNMP

Note Client mobility among controllers works only if auto-anchor mobility (also called guest tunneling) or

symmetric mobility tunneling is enabled. Asymmetric tunneling is not supported when mobility

controllers are behind the NAT device. See the “Configuring Auto-Anchor Mobility” and “Configuring

Symmetric Mobility Tunneling” sections for details on these mobility options.

Figure 11-6 shows an example mobility group configuration with a NAT device. In this example, all

packets pass through the NAT device (that is, packets from the source to the destination and vice versa).

Figure 11-7 shows an example mobility group configuration with two NAT devices. In this example, one

NAT device is used between the source and the gateway, and the second NAT device is used between the

destination and the gateway.

1 2 ... 484 485 486 487 488 489 490 491 492 493 494 ... 635 636

Sem comentários

Cisco Cisco Access Registrar 4.2 Especificações Página 489