WLC: Internal Anchoring Solves VRF Challenge

Internal Anchoring -- Thinking outside of the box

Cisco’s unified guest architecture, also referenced as ‘anchoring or auto anchoring’ is a common way to provide a secured wireless guest solution in an enterprise environment. What makes this secure and unique is the native frame generated by the wireless guest never touches the network switch fabric, until it egresses the anchors outside controller port where the encapsulated frame is unwrapped. At which point, the 802.11 header is stripped and 802.3 headers are installed and the frame is placed on the wire.

You can read more about anchoring here:

http://revolutionwifi.blogspot.com/2010/10/auto-anchor-mobility-fundamentals.html

http://www.cisco.com/en/US/docs/wireless/controller/7.0/configuration/guide/c70mobil.html

Commonly, when the term ‘anchoring’ is mentioned, guest access comes to mind. However, recently I was presented with a challenge where I leveraged Cisco’s anchoring capability to solve a VRF problem. I coined it as, “internal anchoring”.

We have a very large network and deploy VRFs around our campus to segment a certain user group. We were presented with a problem where we could not access the VRF for testing purposes at our IT office, because we did not have our VRF network configured at the IT office location. 

We could have dragged the VRF to our office, which would have involved a good deal of configuration and since it was only going to be used for testing by a handful of network engineers it would have been a lot of work.

So, we did the next best thing…

The location (building), where the VRF user group lives also lives a number of Cisco WLCs supporting wireless connectivity for this VRF building. For sake of this post the WLCs living in this building will be called the VRF/WLC. 

An SSID was created on one of the VRF/WLC as WLAN: VRF_TEST. This WLAN was then anchored to itself, as normal anchoring procedure.

On the other end, at the IT office also lives a WLC. This WLC was providing wireless connectivity to the IT office.  For sake of this post the WLC living in the IT office will be called the IT OFFICE/WLC.  The WLAN: VRF_TEST was created on the IT OFFICE/ WLC and then anchored to the VRF/WLC.

This anchoring process will allow us to simply connect to the VRF_TEST at the IT office and have access to the VRF at the VRF building just like if we were physically there in person. This configuration effort took less than 5 minutes.

** Note: Mobility Group configuration was also required **

Comments

[George]

There is a posibilidty of enable vrf in WLC interfaces?

[George]

No, there isnt. In my example I leveraged anchoring to our internal VRF network which saved a great deal of time having to drag the VRF to the local IT office.