User's Manual

3/11/05 Controller Mobility Group
OL-7426-02
Per-WLAN AssignmentPer-WLAN Assignment
All Cisco SWAN WLANs can be configured to use the same or different DHCP Servers, or no DHCP
Server. This allows operators considerable flexibility in configuring their Wireless LANs, as further
described in the Cisco SWAN WLANs
section.
Note that Cisco SWAN WLANs that support Management over Wireless
must allow the management
(device servicing) clients to obtain an IP Address from a DHCP Server.
Per-Interface AssignmentPer-Interface Assignment
• The Layer 2 Management Interface can be configured for a primary and secondary DHCP
server.
• The Layer 3 AP-Manager Interface can be configured for a primary and secondary DHCP server.
• Each of the Operator-Defined Interfaces can be configured for a primary and secondary DHCP
server.
• The Virtual Interface does not use DHCP servers.
• The Service-Port Interface can be configured to enable or disable DHCP servers.
Security ConsiderationsSecurity Considerations
For enhanced security, it is recommended that operators require all clients to obtain their IP Addresses
from a DHCP server. To enforce this requirement, all Cisco SWAN WLANs can be configured with a
‘DHCP Required’ setting and a valid DHCP Server IP Address, which disallows client static IP Addresses.
If a client associating with a WLAN with ‘DHCP Required’ set does not obtain its IP Address from the
designated DHCP Server, it is not allowed access to any network services.
Note that if ‘DHCP Required’ is selected, clients must obtain an IP address via DHCP. Any client with a
static IP address will not be allowed on the network. The Cisco Wireless LAN Controller monitors DHCP
traffic since it acts as a DHCP proxy for the clients.
If slightly less security is tolerable, operators can create Cisco SWAN WLANs
with ‘DHCP Required’
disabled and a valid DHCP Server IP Address. Clients then have the option of using a static IP Address
or obtaining an IP Address from the designated DHCP Server.
Operators are also allowed to create separate Cisco SWAN WLANs
with ‘DHCP Required’ disabled and a
DHCP Server IP Address of 0.0.0.0. These WLANs drop all DHCP requests and force clients to use a
static IP Address. Note that these WLANs do not support Management over Wireless.
About Controller Mobility GroupsController Mobility Group
Network operators can define Controller Mobility Groups to allow client roaming across groups of Cisco
Wireless LAN Controllers. Because the Cisco Wireless LAN Controllers in Multiple-Cisco Wireless LAN
Controller Deployments can detect each other across the network and over the air, it is important that
each enterprise, institution, and wireless internet service provider isolate their Cisco Wireless LAN
Controllers. The Operating System makes it easy for operators to create this isolation by allowing them
to assign a Controller Mobility Group Name to their Cisco Wireless LAN Controllers. This assignment can
be made using the Web User Interface
, the Cisco Wireless Control System, or the Command Line
Interface.
Note that all the Cisco Wireless LAN Controllers in a Controller Mobility Group must use the same
LWAPP Layer 2 and Layer 3 LWAPP Operation, or you will defeat the Mobility software algorithm.
The following figure shows the results of creating Controller Mobility Group Names for two groups of
Cisco Wireless LAN Controllers. The Cisco Wireless LAN Controllers in the ABC Controller Mobility Group
recognize and communicate with each other through their Cisco 1000 Series IEEE 802.11a/b/g Light-
weight Access Points and Cisco 1030 IEEE 802.11a/b/g Remote Edge Lightweight Access Points and
through their shared subnets, but the ABC Controller Mobility Group tags the XYZ Cisco 1000 Series