This chapter covers the following subjects: The Wireless Network Road Trip: A look at the packet delivery process on a wireless-to-wired net- work. Using VLANs to Add Control: How VLANs are used in wireless networks to separate subnets. Configuring VLANs and Trunks: How to apply a configuration of VLANs and trunks on a Cisco switch. 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 142 CHAPTER 9 Delivering Packets from the Wireless to Wired Network Table 9-1 “Do I Know This Already?” Section-to-Question Mapping Foundation Topics Section Questions The Wireless Network Road Trip 1–4 Using VLANs to Add Control 5–8 Configuring VLANs and Trunks 9–12 Much coordination is involved with the delivery of wireless packets to and from the wire- less networks. This chapter focuses on delivery of packets to the wired network and the path that traffic will traverse. It is intended to give you a good understanding of what de- vices are involved and how they manipulate packets as they are transmitted. You should do the “Do I Know This Already?” quiz first. If you score 80 percent or higher, you may way to skip to the section “Exam Preparation Tasks.” If you score below 80 per- cent, you should spend the time reviewing the entire chapter. “Do I Know This Already?” Quiz The “Do I Know This Already?” quiz helps you determine your level of knowledge of this chapter’s topics before you begin. Table 9-1 details the major topics discussed in this chap- ter and their corresponding quiz questions. 1. When a client wants to send traffic to another device, it must use what protocol to re- solve the MAC addresses? a. ARP b. CDP c. NPR d. OFDM 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 143 2. If a client wants to communicate with a device on another subnet, what device han- dles the communication? a. WLC b. Switch c. AP d. Gateway router 3. How many MAC addresses can be seen in an 802.11 frame? a. 1 b. 2 c. 3 d. 4 4. What protocol is the 802.11 frame encapsulated in when it is sent from the AP to the WLC? a. LDAP b. CDP c. 802.3 d. LWAPP 5. A VLAN is used to define a ___________ and isolate a __________. (Choose two.) a. Logical broadcast domain b. Transparent network c. Virtual trunk d. Subnet 6. Clients see VLANs. True or False? a. True b. False 7. How many VLANs typically are assigned to an access port on a switch? a. 2 b. 4 c. 256 d. 1 144 CCNA Wireless Official Exam Certification Guide 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 144 Chapter 9: Delivering Packets from the Wireless to Wired Network 145 8. What are trunks normally used for? a. Connections between APs b. Connections between switches and clients c. Connections between switches d. Switches do not support trunks 9. Which of the following configurations is used to create a Layer 2 (nonrouted) VLAN on a Cisco IOS–based switch? a. config t interface fa0/1 vlan enable vlan 5 b. config t vlan database vlan vlan enable 7 c. config t vlan 7 end d. config t interface vlan 1 no shut end 10. Which of the following commands is used to create a trunk? a. switchport mode trunk b. switchport trunk enable c. switchport trunk d. trunk enable 11. Which of the following commands defines the native VLAN? a. native vlan 1 b. switchport native vlan 1 c. switchport mode native 1 d. switchport trunk native vlan 1 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 145 12. Which of the following configurations applies VLAN 25 to FastEthernet interface 0/3? a. conf t interface f0/1 switchport mode trunk vlan 25 b. conf t interface f0/3 switchport mode access vlan 25 c. conf t interface f0/3 switchport mode access switchport access vlan 25 d. conf t interface f0/4 switchport mode trunk vlan 25 146 CCNA Wireless Official Exam Certification Guide 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 146 Client B Guest User MAC: AAAA.BBBB.CCCC Client A Corporate User MAC: 0000.0001.0001 SSID: USERNET SSID: GUEST 172.30.1.0/24 10.99.99.0/24 WLCAP Switch Figure 9-1 A Simple Wireless Network Chapter 9: Delivering Packets from the Wireless to Wired Network 147 Foundation Topics The Wireless Network Road Trip At this point, you already have an understanding of how frames are sent on a wireless net- work. In the Cisco Unified Wireless Network, frames do not stay on the wireless network; rather, they travel from a lightweight AP to a wireless LAN controller (WLC). The WLC and lightweight APs are discussed in Chapter 10, “Cisco Wireless Networks Architec- ture.” The purpose of this chapter is to familiarize you with how traffic is kept separate as it travels from the AP to the WLC and then to the wired network. To better understand this process, you must understand how a network typically looks and the process that each device uses to send and receive data. The Association Process To begin, you need a network. This chapter uses the common logical topology seen in Figure 9-1. As you can see, multiple wireless clients are in range of an AP that is advertis- ing multiple service set identifiers (SSID). One SSID puts users on a network that is of- fered to guest users called Guest. The other SSID is called UserNet and is designed for authenticated users of the corporate network. Naturally, more security is going to be ap- plied to users of UserNet, such as authentication and encryption, as opposed to the net- work Guest. The Guest network places users on the 172.30.1.0/24 subnet. The UserNet places users on the 10.99.99.0/24 network. Although these two networks are on different subnets and users associate with different SSIDs, recall that an AP can advertise multiple SSIDs but actually uses the same wireless radio. In the wireless space, the SSID and IP subnet keep the networks logically separated. 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 147 Clients have more than one way to find an AP and associate with it. A client can passively scan the network and listen on each frequency for beacons being sent by an AP, or it can use an active scan process and send a probe request in search of a specific AP. Users of the UserNet would likely actively scan the network, whereas a guest would passively scan. The detailed method of client interaction is covered in Chapter 16, “Wireless Clients.” Getting back to the association process, a client scans the channels hoping to hear a bea- con from an AP or actively sends a probe request. If a probe response is received or a bea- con is heard, the client can attempt to associate with the SSID received in that probe response or beacon. The next step is to authenticate and associate with the AP. When the client chooses an SSID, it sends an authentication request. The AP should reply with an authentication re- sponse. After this occurs and a “Success” message is received, an association request is sent, including the data rates and capabilities of the client, followed by an association re- sponse from the AP. The association response from the AP includes the data rates that the AP is capable of, other capabilities, and an identification number for the association. Next, the client must determine the speed. It does this by determining the Received Signal Strength Indicator (RSSI) and signal-to-noise ratio (SNR), and it chooses the best speed to send at based on these determinations. All management frames are sent at the lowest rate, whereas the data headers can be sent faster than management frames, and the actual data frames at the fastest possible rate. Just as the client determines its rates to send, the AP, in turn, does the same. Now that the client is associated, it can attempt to send data to other devices on the network. Sending to a Host on Another Subnet When a client is associated with an AP, the general idea is to send data to other devices. To illustrate this, first try to send data between Client A in Figure 9-2, which is on the User- Net network, and Client B, which is on the Guest network. Although a typical network would not allow guest users to send traffic to internal WLAN users for security purposes, this will provide an example of how the connection works. The two clients are clearly on two different subnets, so the rules of how IP works are still in play. The clients cannot send traffic directly to each other. Based on normal IP rules, they would first determine that the other is not on the same subnet and then decide to use a default gateway to relay the information. If a client has never communicated with the de- fault gateway, it uses Address Resolution Protocol (ARP) to resolve its MAC address. The process would appear as follows: Step 1. Client A wants to send traffic to Client B. Step 2. Client A determines that the IP address of Client B is not on the same subnet. Step 3. Client A decides to send the traffic to the default gateway of 10.99.99.5. Step 4. Client A looks in its ARP table for a mapping to the gateway, but it is not there. Step 5. Client A creates an ARP request and sends to the AP, as seen in Figure 9-3. 148 CCNA Wireless Official Exam Certification Guide 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 148 172.30.1.0/24 10.99.99.0/24 10.99.99.5 Client B Guest User MAC: AAAA.BBBB.CCCC IP: 172.30.1.1 Gateway: 172.30.1.5 Client A Corporate User MAC: 0000.0001.0001 IP: 10.99.99.1 Gateway: 10.99.99.5 SSID: USERNET SSID: GUEST Figure 9-2 Client A Communicating with Client B Frame Control ARP 000c.0001.0101 ADDRESS 1 0000.0001.0001 ADDRESS 2 FFFF.FFFF.FFFF ADDRESS 3 ARP WHO IS 10.99.99.5 172.30.1.0/24 BSSID: 000c.0001.0100 10.99.99.0/24 BSSID: 000c.0001.0101 10.99.99.5 Client B Guest User MAC: AAAA.BBBB.CCCC Client A Corporate User MAC: 0000.0001.0001 SSID: USERNET SSID: GUEST Figure 9-3 ARPing for the Gateway Chapter 9: Delivering Packets from the Wireless to Wired Network 149 Key Topi c 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 149 150 CCNA Wireless Official Exam Certification Guide When the ARP request is sent to the AP, it is an interesting process and actually works a little bit differently than on a wired network. Remember that on a wired network, the header has only two MAC addresses: the source address and the destination address. An 802.11 frame can have four addresses: the source address (SA), destination address (DA), transmitter address (TA), and receiving address (RA). In this situation, the SA is the MAC of the client sending the ARP request, the DA is broadcast (for the ARP), and the RA is the AP. No TA is present in this example. Figure 9-4 shows the ARP request. The AP receives the ARP and sees its MAC address. It verifies the frame check sequence (FCS) in the frame and waits the short interframe space (SIFS) time. When the SIFS time expires, it sends an ACK back to the wireless client that sent the ARP request. This ACK is not an ARP response; rather, it is an ACK for the wireless frame transmission. The AP then forwards the frame to the WLC using the Lightweight Access Point Protocol (LWAPP), as illustrated in Figure 9-5. The LWAPP frame that travels from the AP to the WLC is traveling on a wired network. This brings forth the question, “What happened to the 802.11 frame format?” LWAPP Frame Control ADDRESS 1 000c.0001.0101 ADDRESS 2 0000.0001.0001 ADDRESS 3 FFFF.FFFF.FFFF ARP REQUEST Figure 9-4 ARP Request ARP LWAPP AP ADDRESS CONTROLLER ADDRESS 172.30.1.0/24 10.99.99.0/24 Client B Guest User MAC: AAAA.BBBB.CCCC Client A Corporate User MAC: 0000.0001.0001 SSID: GUEST SSID: GUEST Figure 9-5 ARP Forwarded in LWAPP Frame Key Topi c Key Topi c 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 150 Chapter 9: Delivering Packets from the Wireless to Wired Network 151 Controller to Wired Net AP to Controller Client to AP Client A Switch 10.99.99.5 Gateway WLC AP ARP LWAPP AP ADDRESS CONTROLLER ADDESS DESTINATION FFFF.FFFF.FFFF SOURCE 0000.0001.0001 ARP REQUEST U U Frame Control ARP REQUEST ADDRESS 1 000c.0001.0101 ADDRESS 2 0000.0001.0001 ADDRESS 3 FFFF.FFFF.FFFF Figure 9-6 WLC Forwarding the ARP Toward the Gateway simply encapsulates the frame inside a 6-byte header. The new 6-byte header has the AP IP and MAC address as the source and the WLC IP and MAC address as the destination. Encapsulated inside of that header is the original 802.11 frame with the three MAC ad- dresses, including the broadcast MAC address for the ARP process. When the WLC re- ceives the LWAPP frame, it opens the frame revealing the ARP request and rewrites the ARP request in an 802.3 frame that can be sent across the wired network. The first ad- dress from the 802.11 frame is dropped, the second address is placed as the source address in the new 802.3 frame, and the third address, the broadcast address, is placed as the desti- nation address. The WLC then forwards the ARP request, in 802.3 format, across the wired network, as seen in Figure 9-6. Here you can see how the frame appears between the wireless Client A and the AP, how the AP encapsulates the frame and sends it to the WLC, and how the WLC rewrites the frame and sends it to the wired network. As switches receive the ARP request, they read the destination MAC address, which is a broadcast, and flood the frame out all ports except the one it came in on. The exception to this rule is if VLANs are in use, in which case the frame would be flooded to all ports that are members of the same VLAN. Assuming that VLANs are not in use, the frame, as stated, is flooded out all ports except the one it came in on. Key Topi c 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 151 . switch? a. 2 b. 4 c. 256 d. 1 144 CCNA Wireless Official Exam Certification Guide 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 144 Chapter 9: Delivering Packets from the Wireless to Wired Network 145 8 Delivering Packets from the Wireless to Wired Network 149 Key Topi c 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 149 150 CCNA Wireless Official Exam Certification Guide When the ARP request is. Client A creates an ARP request and sends to the AP, as seen in Figure 9-3. 148 CCNA Wireless Official Exam Certification Guide 10_1587202115_ch09.qxp 9/29/08 2:39 PM Page 148 172.30.1.0/24 10.99.99.0/24 10.99.99.5 Client