Configure Workgroup Bridge (WGB) Wired Clients with NAT
Available Languages
Introduction
This document describes the configuration of wired clients behind Network Access Translation to access the network via Workgroup Bridge.
Prerequisites
Requirements
Cisco recommends you have knowledge of these topics:
- 9800 Wireless Lan Controller (WLC) concepts and configuration
- Workgroup Bridge (WGB) concepts and configuration
- Network Access Control (NAT) concepts and configuration
- Switching concepts and configuration
Components Used
The information in this document is based on these software and hardware versions:
- 9800-CL WLC Cisco IOS® XE 26.1.1
- WGB WP-WIFI6-B integrated in 1821 router version 26.1.1
- Catalyst IR1821 Rugged Router, Cisco IOS 17.15.4
- 9300 Switch, Cisco IOS 17.15.4
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Background Information
There are WGB implementations that require the wired clients behind the WGB to be in a different vLAN than the WGB and at the same time that vLAN does not exist in the WGB, WLC or in the network devices behind the WLC.
In this scenario, using NAT provides the configuration and flexibility needed to make the wired clients communicate with the network (applications, internet, servers, and so on) behind the WLC.
Network Diagram
Topology
Configure
Wireless LAN Controller
This section explains the basic configuration of the WLAN, WLAN-Policy Profile and Policy Tag in order to broadcast the Service Set Identifier (SSID) the WGB connects to.
Caution: Any configuration change on these parameters in production can cause a wireless client disconnection.
Step 1. Configure the SSID.
Step 1.1. Navigate to Configuration > Tags & Profiles > WLANs. Click Add. Enter the Profile and SSID name. Click Apply.
GUI:
Wlan Config
CLI:
config t
wlan WGB 6 WGB
radio policy dot11 5ghz
no shutdown
Step 1.2. Configure the SSID security parameters. Choose PSK, enter the PSK password, and click Apply.
GUI:
Wlan Security
CLI:
config t
wlan WGB 6 WGB
shutdown
no security ft adaptive
security wpa psk set-key ascii 0 12345678
no security wpa akm dot1x
security wpa akm psk
no shutdown
Step 1.3. Configure AironetIE in the SSID. Navigate to the Advanced tab, enable CCX Aironet IE, and click Apply.
GUI:
Aironet IE
CLI:
config t
wlan WGB 6 WGB
shutdown
ccx aironet-iesupport
no shutdown
Step 2. Configure the WLAN-Policy Profile.
Step 2.1. Navigate to Configuration > Tags & Profiles > WLANs. Click Add. Enter a Name. Configure as Enable the Status and Passive Client. Then click Apply.
GUI:
WLAN Policy
CLI:
config t
wireless profile policy PolicyWGB
passive-client
no shutdown
Step 2.2. Navigate to Access Policies. Click VLAN/VLAN Group and choose the WGB vLAN.
GUI:
Vlan Config
CLI:
conf t
wireless profile policy PolicyWGB
shutdown
vlan VLAN3246
no shutdown
Step 3. Configure the Policy Tag and apply it to the Access Points (AP) the WGB connects to.
Step 3.1. Navigate to Configuration > Tags & Profiles > Tags. Click Policy, and then on Add. Enter a Name and then click Add. Choose the SSID and the Policy Profile. Click Apply.
GUI:
Tag
CLI:
config t
wireless tag policy WGBTag
wlan WGB policy PolicyWGB
Note: Remember to apply to Policy Tag to all the Access Points that broadcast the SSID.
Workgroup Bridge
This section explains the configuration on the WGB. The configuration allows the WGB to connect to the network and gain connectivity through vLAN3246.
CLI:
configure ap hostname WGB1
configure ap address ipv4 static 10.10.246.4 255.255.255.0 10.10.246.1
configure ap management add username admin password P0ssw0rd123! secret P0ssw0rd123!
configure ssid-profile WGB ssid WGB authentication psk 12345678 key-management wpa2
configure dot11Radio 1 mode wgb ssid-profile WGB
configure dot11Radio 1 enable
Router
This section explains how to configure NAT in order to allow connectivity between the wired clients in vLAN3248 to the vLAN3246.
vLAN3248 resides only in the router and has no connectivity at all to the side of the network that is behind the WLC.
The router does NAT to transport the traffic of the wired clients in vLAN3248 to the side of the network behind the WLC in vLAN3246 through the WGB.
Note: For the wired clients connected to the router behind the WGB, in order to have connectivity out of their vLAN the only supported configuration is NAT. Inter-vLAN routing is not supported.
Step 1. Configure the vLAN 3246 and vLAN 3248 at a layer two level.
conf t
vlan 3246
exit
vlan 3248
end
Step 2. Configure the port of the WGB from the router.
conf t
interface Wlan-GigabitEthernet 0/1/4
switchport trunk native vlan 3246
switchport trunk allowed vlan 3246
switchport mode trunk
Step 3. Configure the Switched Virtual Interface (SVI) of the WGB vLAN and the wired client vLAN.
Step 3.1. WGB SVI configuration. The IP address 10.10.246.1 is the gateway for vLAN 3246 configured in the Layer 3 switch behind the WLC. This SVI in the router is using the next usable IP address.
config t
interface Vlan3246
ip address 10.10.246.2 255.255.255.0
Step 3.2. Wired clients interface vLAN configuration. Wired clients in the router use vLAN 3248. This SVI is the gateway of the wired clients since these clients exist only in this router. Configure a unique MAC address for this SVI.
config t
interface Vlan3248
mac-address 6c13.d53f.aabb
ip address 10.10.248.1 255.255.255.0
Caution: Configure an unique MAC address per SVI. The router uses the same MAC address for all the SVIs by default and this can create conflict in this implementation.
Step 4. Configure an Access List (ACL) and permit the network of the wired clients.
config t
ip access-list extended NATACL
10 permit ip 10.10.248.0 0.0.0.255 any
Step 5. Configure a route-map that matches the ACL and the WGB interface.
conf t
route-map WGBACL permit 10
match ip address NATACL
match interface Vlan3246
Step 6. Configure NAT.
Step 6.1. Configure NAT in the SVIs. The SVI 3248 is the NAT inside and 3246 the NAT outside.
config t
interface Vlan3248
ip nat inside
exit
interface Vlan3246
ip nat outside
Step 6.2. Configure NAT in the router. Use the route-map as source. This configuration permits the wired clients on vLAN3248 to have connectivity with the network in vLAN3246 behind the WLC.
config t
ip nat inside source route-map WGBACL interface Vlan3246 overload
Step 6.3 This step is optional, if there is a need to access the devices behind the WGB in vLAN3248 from devices behind the WLC in vLAN3246 it can be configured via NAT.
As an example, the configuration shown demonstrates how to configure access for a device behind the router and WGB with IP address 10.10.248.10 via Remote Desktop Protocol (RDP) from devices behind the WLC in vLAN3246.
Any port can be used which depends on what needs to be accessed (SSH, Telenet, RDP, HTTP, and so on) in the device behind the router in vLAN 3248.
In order to access the 10.10.248.10 device via RDP from a device in vLAN3246, the RDP connection is made to the SVI of the 3246 vLAN in the router (10.10.246.2), check the Verify section of this document.
config t
ip nat inside source static tcp 10.10.248.10 3389 interface Vlan3246 3389
Step 7. Configure the wired client port in vLAN 3248 on the router.
config t
interface GigabitEthernet0/1/0
switchport mode access
switchport access vlan 3248
Note: This configuration use wired clients in vLAN 3248 with static IP addresses. If DHCP is needed, it can be configured in the router.
Verify
Verify the connection of the WGB and the SVI of the vLAN 3246 listed as a wired client. Also, confirm connectivity of the wired clients on vLAN 3248 to the network, send a ping to the gateway of vLAN 3246 that exist behind the WLC.
Wireless LAN Controller
Check from the WLC the WGB and the SVI of the vLAN 3246 configured in the router are shown in the wireless client list.
GUI:
WGB and WGB Client
CLI:
9800L#show wireless client summary
Number of Clients: 2
MAC Address AP Name Type ID State Protocol Method Role
------------------------------------------------------------------------
6c13.d53f.f8f4 C9124AXI-B WLAN 6 Run 11ac None Local
e462.c49f.790f C9124AXI-B WLAN 6 Run 11ac None Local
9800L#show wireless client summary detail
Number of Clients: 2
MAC Address SSID AP Name State IP Address VLAN BSSID Auth Method Protocol Channel Width
---------------------------------------------------------------------------------------------------------------------
6c13.d53f.f8f4 WGB C9124AXI-B Run 10.10.246.2 3246 5c64.f171.6eae [PSK] 11ac 36 20/20
e462.c49f.790f WGB C9124AXI-B Run 10.10.246.4 3246 5c64.f171.6eae [PSK] 11ac 36 20/160
9800L#show wireless wgb summary
Number of WGBs: 1
MAC Address AP Name WLAN State Clients
-------------------------------------------------------
e462.c49f.790f C9124AXI-B 6 Run 1
Workgroup Bridge
Confirm the WGB shows as connected to the SSID.
WGB#show wgb dot11 associations
Uplink Radio ID : 1
Uplink Radio MAC : E4:62:C4:9F:79:0F
SSID Name : WGB
Connected Duration : 0 hours, 7 minutes, 9 seconds
Parent AP Name : C9124AXI-B
Parent AP MAC : 5C:64:F1:71:6E:AE
Uplink State : CONNECTED
Auth Type : PSK
Key management Type : WPA2
Dot11 type : 11ac
Channel : 36
Bandwidth : 20 MHz
Current Datarate : 104 Mbps
Max Datarate : 286 Mbps
RSSI : 41
IP : 10.10.246.4/24
Default Gateway : 10.10.246.1
IPV6 : ::/128
Assoc timeout : 5000 Msec
Auth timeout : 5000 Msec
Dhcp timeout : 60 Sec
Country-code : US
Confirm the SVI of the vLAN 3246 shows in the WGB bridge table.
WGB#show wgb bridge
***Client ip table entries***
mac vap port vlan_id seen_ip confirm_ago fast_brg
6C:13:D5:3F:F8:F4 0 wired0 0 10.10.246.2 28.112000 true
5C:64:F1:71:6E:AF 0 wbridge1 0 0.0.0.0 1064.320000 true
Router
From the router confirm it is reachable from vLAN3248 to the network behind the WLC in vLAN3246 and it is successful.
Router#ping 10.10.246.1 source vlan 3248
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.10.246.1, timeout is 2 seconds:
Packet sent with a source address of 10.10.248.1
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 4/7/8 ms
Confirm NAT translations are shown properly.
Router#show ip nat translations
Pro Inside global Inside local Outside local Outside global
icmp 10.10.246.2:12 10.10.248.1:12 10.10.246.1:12 10.10.246.1:12
Total number of translations: 1
If the optional configuration step of NAT is used, then confirm RDP connectivity from vLAN3246 to a device in vLAN3248 is successful.
RDP is used in the example of this document, however, any other protocol can be used.
Use the SVI of the vLAN3246 configured in the router which is 10.10.246.2 to RDP the device 10.10.248.10 behind the router in vLAN3248.
RDP Remote Device
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
08-Sep-2026
|
Initial Release |
Feedback