There is great document explaining how to configure Option 43 on ISC DHCP server on the Cisco website.
If all you need is a simple DHCP server which will assign Option 43 to all devices on the network, without selectively assigning it only to specific AP models using the class construct, you can simplify your ISC DHCP server configuration to this. It works great on a WLAN Pi.
Configuration
# Linux ISC DHCP server configuration in /etc/dhcp/dhcpd.conf
option space Cisco_LWAPP_AP;
option Cisco_LWAPP_AP.server-address code 241 = array of ip-address;
# eth0 DHCP scope
subnet 192.168.73.0 netmask 255.255.255.0 {
interface eth0;
range 192.168.73.100 192.168.73.200;
option routers 192.168.73.1;
option domain-name-servers 208.67.222.222, 208.67.220.220;
default-lease-time 86400;
max-lease-time 86400;
vendor-option-space Cisco_LWAPP_AP;
option Cisco_LWAPP_AP.server-address 10.10.10.10, 10.20.20.20;
}
Verification
The access point will get its IP configuration from the DHCP server including Option 43 and will try to join these controllers.
I am in the market of buying a new pair of power line adapters. Power line is a great alternative or complement to Ethernet and Wi-Fi. It provides low latency and jitter and is very flexible and easy to install.
The current tp-link TL-PA6010 adapters have served me well, but they are now reaching their maximum throughput. So, I decided to get a new pair of the fastest adapters on the market (Devolo Magic 2 Wi-Fi) and also a pair of the best adapters from tp-link (TL-PA9020P). These will be used to connect my home office and lab networks to my router.
Since there are multiple brands offering a variety of products with a variety of advertised speeds, I am curious to see if the more expensive adapters are worth the premium price, what real throughput they would provide and if and how much a passthrough socket improves the power line speed.
I tested my current low-end adapters and two new high-speed ones:
Throughput, ping, jitter, power and Wi-Fi tests
Power line speeds vary and depend on the distance between the two adapters, your electrical wiring and interference. Please take the numbers below as relative ones, which would allow you to compare how these adapters perform under the same conditions and in the same setup.
All throughput numbers below were TCP measurements taken by iPerf3 running on a WLAN Pi (a single-board computer with 1 Gbps Ethernet) and the client was my MacBook with 1 Gbps USB-C Ethernet adapter. There were no intermediate network devices between them:
MacBook iPerf3 client <-> PLC1 <-> PLC2 <-> WLAN Pi iPerf3 server
The average download speed (measured 5 times at each of the locations in my house) ranges from 13% to 26% of the advertised speeds and goes nowhere near them. With £16 per 100 Mbps, the cheapest adapter seems to be the best value for money, unless you need higher speed and are willing to pay for it. It also is the most power efficient.
Devolo Magic 2 proved to the be the fastest solution with 331 Mbps average download speeds, while TL-PA9020P provided slightly better upload speeds than Devolo.
Each of the parameters (i.e. Download average) consisted of five iPerf3 tests in each location and I then computed the average values:
Built-in Wi-Fi access point
Devolo Magic 2 Wi-Fi remote adapter comes with a built-in dual-band 802.11ac Wi-Fi AP (not just a repeater as some of the cheaper adapters), but it is unstable and resets the power line connection every single time I connect and generate some traffic. I used the latest firmware available in July 2020. If a built-in Wi-Fi is a must-have for you, do NOT buy this adapter. Wait until it gets fixed or look for alternatives.
This is what happens. The SSID is broadcast, a Wi-Fi client can associate to the AP, but when the iPerf test starts, the client gets disconnected and power line connection is torn down for 10 seconds or so and then re-establishes. I was able to reproduce this bug every single time and it was not just one-off random problem.
On the positive note, it supports 2.4 GHz only, 2.4 + 5 GHz or 5 GHz only modes. It does not let you change channel width on 5 GHz though and always uses 80 MHz, which may sound like a good idea in a small town, but it is a disaster in a shared building with many other access points and neighbours present.
If high-speed power line without Wi-Fi is what you are after, then the Magic 2 non-Wi-Fi model could be a good option for you.
Passthrough socket
Passthrough socket allows you to plug an electrical appliance to the power line adapter without generating the socket your adapter is plugged into unusable. Cheaper adapters usually do not provide this.
The other benefit is that adapters with passthrough socket use filters to suppress noise coming from the connected electrical appliance and this improves speed by 13% – 15%.
Pros and cons
Devolo Magic 2 Wi-Fi + Fastest average download speed + Comes with a mobile app and each unit has a management web GUI – Built-in access point resets the whole unit and Wi-Fi is not usable – It runs quite warm compared to the other two and is the largest
tp-link TL-PA9020P + Very good and symmetrical performance + Stable – No built-in Wi-Fi – Still quite expensive compared to the slower and cheaper units
tp-link TL-PA6010 (or similar) + Great value for money + Stable – Relatively low speeds – No passthrough socket, no Wi-Fi
And the winner is…
My personal preferences are very likely different from yours and that is fine. I am looking for symmetrical TCP throughput of at least 200 Mbps, ideally a passthrough socket support and all other features are nice to have.
Devolo Magic 2 Wi-Fi proves to be unstable as the built-in access point crashes the whole adapter and resets the power line connection. Its back side also becomes quite warm regardless the load.
So, I decided for tp-link TL-PA9020P. It is stable, does all I need it to do and both adapters come with 2 Ethernet ports which gives me flexibility to plug my own access point in or connect using wired Ethernet connection.
Here is how to configure Option 43 on an MX appliance for a Cisco Aironet or Catalyst AP to discover its Wireless LAN Controller (WLC).
My Catalyst 9800-CL controller IP address: 173.38.219.33
Meraki MX appliance DHCP server configuration
Open Dashboard and go to Security & SD-WAN > Configure > DHCP > scroll down to the right VLAN > DHCP options > Add a DHCP option:
Format of the hex string
In my example, the final string would be “f1:04:ad:26:db:21”
“f1:04” tells the AP that only one WLC IP address is used, followed by the actual address “ad” is hex representation of 173 “26” is hex representation of 38 “db” is hex representation of 219 “21” is hex representation of 33
To convert the 4 decimal octets of the IP address to hexadecimal format, you can use this online tool, macOS Calculator or Windows Calculator.
Verification on the AP
Two controllers
If you provide the AP with IP addresses of 2 standalone controllers (think N+1 HA mode), then simply change “f1:04” to “f1:08” and append the second controller’s IP address in hex representation to the end of the hex string.
Primary controller IP address: 173.38.219.33 Secondary controller IP address: 173.38.219.34 Hex string: f1:08:ad:26:db:21:ad:26:db:22
We have all been there. It is the night before an important training or meeting and you need to install few more packages on your WLAN Pi or push some code changes to GitHub. Guess what? There is no wired connection available in your room and the hotel Wi-Fi uses a captive portal or is very poor.
iPhone USB tethering on the WLAN Pi lets you use your iPhone or iPad as a cellular modem and share the internet connectivity with the WLAN Pi. It also charges your iPhone, which is nice.
How to enable iPhone USB tethering on WLAN Pi
Simply follow these steps:
Connect to the WLAN Pi using SSH and run this command. Do not skip this step, it is required: sudo apt-get update
Then install this package: sudo apt-get install usbmuxd
Plug your iPhone into the WLAN Pi using a lightning to USB-A data cable.
On the iPhone, go to Settings > Personal Hotspot > Allow Others to Join.
A new eth1 interface will appear on the WLAN Pi.
Tap on the Trust button on your iPhone/iPad and enter your passcode.
After you click Trust, the eth1 interface will get a dynamically assigned IP address by the DHCP server running on the iPhone.
Your WLAN Pi is now connected to the internet. You can verify using the Reachability tool in the Front Panel Menu System (FPMS). Go to Menu > Utils > Reachability.
Share iPhone internet connection with multiple devices on you LAN
You can even take this one step further. Perhaps you have multiple other devices connected to a switch and you need to provide temporary internet connectivity to all of them. That is where the USB Tethering mode comes to the rescue.
The easiest solution is to tweak the existing Hotspot mode on your WLAN Pi. In most cases we will replace wlan0 with eth0 and eth1.
Before you start, please backup all these files or ideally start with a fresh SD card and fresh WLAN Pi image.
Edit this file: sudo nano /etc/wlanpihotspot/default/isc-dhcp-server
Update this line to: "INTERFACESv4="usb0 eth0"
Edit this file: sudo nano /etc/wlanpihotspot/dhcp/dhcpd.conf
Update this block to: # eth0 DHCP Scope subnet 192.168.88.0 netmask 255.255.255.0 { interface eth0;
Edit this file: sudo nano /etc/wlanpihotspot/network/interfaces
Update these lines and comment some out: allow-hotplug eth0 iface eth0 inet static #Wired ethernet #allow-hotplug eth0 #iface eth0 inet dhcp
Edit this file: sudo nano /etc/wlanpihotspot/ufw/before.rules
Update this line to: -A POSTROUTING -s 192.168.88.0/24 -o eth1 -j MASQUERADE
However strange it sounds, plug a supported Wi-Fi adapter into a USB port of your WLAN Pi. Without the adapter plugged in, the WLAN Pi will not switch from the Classic mode to the Hotspot mode.
Now go to Menu > Modes > Hotspot > Confirm
Your WLAN Pi will reboot. Disconnect the Wi-Fi adapter, we do not need it anymore.
The WLAN Pi will do PAT (Port Address Translation) on its eth1 outside interface. On the inside eth0, it will start DHCP server and share the iPhone cellular internet connection with all devices on your LAN.
Here is a traceroute output from one of the devices connected to the switch. First hop to the internet is WLAN Pi’s eth0 interface and second is the iPhone’s inside interface.
A word of caution
While this new mode is a great feature, it can potentially cause some harm. Please read before you tweak.
In this mode, WLAN Pi runs DHCP server on the built-in eth0 interface. At no circumstances you want to plug it to an existing corporate network and especially one which is not under your management. Your WLAN Pi might take over clients of the existing DHCP server and route all traffic via the cellular connection. If you have not already, I highly recommend you enable DHCP snooping on your switches. This is a security feature and will block untrusted DHCP servers connected to your network.
Double-check that your data plan is suitable for tethering. Your mobile operator will charge you for the cellular data services.
You are potentially opening a backdoor to the existing LAN network over the cellular connection.
Always switch your WLAN Pi back to the Classic mode before shutting it down. Next time you use it, it will boot up to the Classic mode, which is safe by design.
Your feedback counts
If you find this feature useful, let us know. Perhaps a new “USB Tethering” mode might be a nice addition and will save you time editing the configuration files manually.
Although the WLAN Pi team implements most of the new features into the official image, it also assesses all security aspects. At the end of the day, everyone’s goal is to maintain high standards.
My setup
I have successfully tested this setup with iPhone 8 Plus and WLAN Pi NEO2 Black running 1.9.1-RC2 release. Please add a comment to this post with your setup so that we know what has been tested and works.
Officially, vWLC is not supported on Type-2 hosted hypervisors like Fusion or Workstation. However, if you need to build a non-production lab, portable demo or practice for your next exam, technically you can run vWLC in VMware Fusion.
The trick is to install Fusion on your Mac, create a new VM with the free ESXi Hypervisor (or the full-blown one if you have licenses) and deploy vWLC onto the ESXi:
macOS <-> VMware Fusion <-> ESXi Hypervisor running as a VM <-> vWLC VM
It may sound complex, but is actually quite easy to do and runs like a charm even on a 13″ Intel i5 MacBook Pro.
Download the vWLC OVA image from Cisco.com.
Download VMware vSphere Hypervisor 6.7 ISO. Register on their website to get a free license key.
Download the ovftool 4.3.0 (older versions may not work correctly) for Windows and make sure you have a Windows machine or VM by hand as ovftool only runs on Windows.
Create a new VM in VMware Fusion, mount the Hypervisor ISO and install ESXi. Configure networking for this VM as Bridged Networking to Wi-Fi or Ethernet. Wi-Fi is a great option as it allows you to move freely with your Mac whilst running the vWLC.
With the free ESXi Hypervisor, we have to deploy the vWLC OVA using the ovftool. This will help us get past the errors we would have otherwise ran into the ESXi web GUI. To do this we need a Windows machine.
Install the ovftool in the Windows machine, transfer the vWLC OVA archive to it and deploy the OVA onto ESXi:
The IP address in this string “vi://192.168.196.136” is our ESXi address. You may have noticed that I am using the same network for both Service Port and Management interfaces. After I deploy the OVA, I usually disable the Service Port adapter in the VM settings and use Management interface for management and for APs to join. It just keeps things simple and we don’t need to worry about multiple adapters and subnets.
You can set the vWLC VM to Autostart and start it manually now.
Open Console to it and press any key to activate the console access.
Follow the installation guide.
If you are running the evaluation license, accept the EULA. If you purchased AP licenses, add then to the controller and accept the EULA.
Since vWLC only supports Flexconnect mode APs, make sure to convert your APs manually or apply this CLI command:
config ap autoconvert flexconnect
Finally connect your AP to a PoE capable switch or power injector and it should be able to discover and join the virtual controller.
Note: If you installed vWLC VM directly onto Fusion with no ESXi Hypervisor layer, the controller would not be able to communicate on its Management interface.
Catalyst 9800-CL IOS-XE controller
The above scenario covers the AireOS vWLC. Cisco now has a complete range of Catalyst 9800 series controllers with feature parity between them. The new virtual controller is called Catalyst 9800-CL and it brings all the great IOS-XE features, HA SSO, programmability, hot patching and supports all AP modes.
