VLAN Mismatch on Trunk to Access Point
A company deploys Aruba 2930F switches and Aruba 315 access points. The APs are connected to switch ports configured as trunk with native VLAN 1 and allowed VLANs 10,20,30. The AP management VLAN is 10, and SSIDs map to VLANs 20 and 30. Users report that wireless clients obtain IP addresses from the management VLAN 10 instead of their intended VLANs. The network administrator suspects a VLAN configuration issue on the switch port. The AP is powered via PoE and is operational.
1. What is the most likely cause of clients receiving IP addresses from VLAN 10?
Read the worked answer
The AP trunk port likely has VLAN 10 as the native VLAN, and the AP management interface is untagged on that VLAN. When the AP forwards client traffic, it may be tagging client frames with VLAN 20 or 30, but if the switch port is not properly configured to allow those VLANs, or if the AP's bridge mode is not set to tag client traffic, the frames may be sent untagged and thus placed in the native VLAN (10). Reasoning: In Aruba APs, when operating in bridge mode, the AP tags client traffic with the VLAN ID configured in the SSID profile. The switch port must allow that VLAN and the AP must be configured to tag. If the AP is not tagging (e.g., because the SSID is configured for VLAN 10 or because the AP's management VLAN is untagged), clients end up in VLAN 10. The fix is to ensure the AP's SSID VLANs are tagged and the switch port allows them.
2. How would you verify the VLAN assignment on the switch port and on the AP?
Read the worked answer
On the switch, use show running-config interface <port> to check the trunk configuration: native VLAN, allowed VLANs, and whether VLAN 10 is untagged. Also show vlans to confirm VLANs exist. On the AP, check the SSID profile configuration (via Aruba Central or local UI) to see the VLAN assigned to each SSID and whether it is tagged. Use show datapath bridge on the AP CLI to see VLAN tagging per client. Reasoning: The switch port must be configured with vlan trunk allowed 10,20,30 and vlan trunk native 10 (or another VLAN) and the AP must be configured to tag client traffic with VLAN 20/30. Mismatch causes untagged frames to fall into native VLAN.