Cisco 2100 Series, Configuration Manual

Page: 644 / 796

12-26
Cisco Wireless LAN Controller Configuration Guide
OL-17037-01
Chapter 12 Configuring Mobility GroupsWireless Device Access
Using Symmetric Mobility Tunneling
*Controllers running software release 5.2 do not support this security policy.
Using Symmetric Mobility Tunneling
Controller software releases 4.1 through 5.1 support both asymmetric and symmetric mobility tunneling.
Controller software release 5.2 supports only symmetric mobility tunneling, which is now always
enabled by default.
In asymmetric tunneling, client traffic to the wired network is routed directly through the foreign
controller, as shown in
Figure 12-17 .
Figure 12-17 Asymmetric Tunneling or Uni-Directional Tunneling
Asymmetric tunneling breaks when an upstream router has reverse path filtering (RPF) enabled. In this
case, the client traffic is dropped at the router because the RPF check ensures that the path back to the
source address matches the path from which the packet is coming. When symmetric mobility tunneling
is enabled, all client traffic is sent to the anchor controller and can then successfully pass the RPF check,
as shown in
Figure 12-18 .
0x00000080 Security_WPA_NotUsed
0x00000100 Security_Cranite_Passthrough*
0x00000200 Security_Fortress_Passthrough*
0x00000400 Security_L2TP_IPSec*
0x00000800 Security_802_11i_NotUsed*
0x00001000 Security_Web_Passthrough
Table 12-2 WLAN Mobility Security Values (continued)
Security Hexadecimal Value Security Policy
Router
Server
Anchor Foreign
Mobile
210899
Mobile