vSZ-D Tunnelling WLAN with VLAN Tag What i am missing

[lasha_chavleshv]

The problem is when i create WLAN and tagged it with DATA VLAN ID 234 , (i used Tunnel WLAN traffic to the controller) my client can't get IP address from DATA VLAN, try it with static IP address assignment, my device still can't ping my DATA VLAN Gateway 10.26.0.1
 I look around the configuration and still not working. What i am missing
Vsz-H version 3.5.1.0.862
Vsz-D version 3.5.1.0.862
AP-R700 Router Cisco DHCP-SERVER and Gateway

SW-Juniper

Virtual :
Vsz-D Data interface IP 10.26.0.5
MGMT interface IP 10.1.115.16 Vsz-H
MGMT interface IP 10.1.115.15

AP IP 10.1.115.17
all port Trunk.
My Topology

[harald_thomas_c]

Hi Rafael,

on the VMware host you can use different port groups depending on your license.
the normal vSwitch can handle:

• untagged (whatever comes untagged on the physical NIC/s comes untagged to the VM)
• tagged (the network with the selected VLAN Tag comes tagged on the physical NIC/s and will be an access port in the VLAN to the VM; tagged outside of the VM will be turned to access facing the VM)
• 4095 (replication of all VLANs from the physical NIC/s to the VM, untagged will stay untagged, tagged will stay tagged; no selection possible)

on a distibuted vSwich (only Enterprise plus license) you have an addition feature:

• selective VLANs (you can select multiple VLANs to be delivered to the VM, all will be tagged)

For the vSZ-D to access multi VLANs for multi SSIDs you need 4095 or selective VLANs.
AND on the PG all security option (promiscuous mode, etc...) must be set to "accept".

Now the vSZ-D part:
On the data interface only the VLAN/IP for the APs to connect to has to be configured. Depending on your configuration you need to specify a VLAN for the interface.
All other VLANs will be configured in the SSID configuration.

cheers,
Harald

[rafael_rocha_i5]

Thank you for you answer Harald !!
I was able to make it work. 
Still, I am having trouble with my tunnel ssids that use the captive portal from the controller.
My guess is that  my management port is not tagged correctly, because I can't see how from the data interface my unauthenticated wireless traffic will be intercept without my controller being my gateway nor inlane. 
Did you have any advice where I should look ? Is there a different configuration in smartzone pertain tunnel traffic that I should do to make the captive portal work ??? 

[harald_thomas_c]

Hi Rafael,

can you pls send the vlan configuration of the physical switch ports that are connected to the uploads of your vswitch and the configuration of the port groups connected to the management and data interface.

cheers,
Harald

[rafael_rocha_i5]

Hi harald, sorry, I can't send. This configuration was of a client that I helped. The switches was not my responsibility. I only instructed and let the client investigated and fixed by himself. The last part of the problem was physical switch missing one vlan connect to the vmware server and fault/broken ethernet cable.
You could make the ports vlan trunk all, it should work only need to make sure about the native vlan.

[harald_thomas_c]

Are you using a vSwitch or a distributed vSwitch?