DSA and 802.1x with dynamic VLAN

[m.kuss]

I try to enable dynamic VLAN (802.1x) for WiFi on a Linksys MX4200v1 device. There is an existing/working setup with DAP-2695 (OpenWrt). Radius work for both WiFi-devices, but the VLAN assignment does not work on MX4200v1.

MX4200v1: On the bridge device "br-lan" VLAN filtering is activated (DSA approach). Corresponding "br-vlanX" bridges devices are available. For wired ports VLAN works, but I'm not able to enable dynamic VLAN assignment for WiFi. The error message is:

daemon.info hostapd: phy0-ap0: STA [MAC] IEEE 802.11: authenticated
daemon.info hostapd: phy0-ap0: STA [MAC] IEEE 802.11: associated (aid 1)
daemon.notice hostapd: phy0-ap0: CTRL-EVENT-EAP-STARTED [MAC]
daemon.notice hostapd: phy0-ap0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=1
daemon.err hostapd: Failed to create interface phy0-ap0.2: -95 (Not supported)
daemon.notice hostapd: phy0-ap0: CTRL-EVENT-EAP-RETRANSMIT2 [MAC]

I tried the wifi-vlan in /etc/config/wireless as well. But I got always this:

daemon.err hostapd: Failed to create interface phy0-ap0-2: -95 (Not supported)

/etc/config/network

config interface 'loopback'
	option device 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'
	option ula_prefix 'fdde:24ae:ce5f::/48'
	option packet_steering '1'

config device
	option name 'br-lan'
	option type 'bridge'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'wan'

config interface 'lan'
	option device 'br-lan.13'
	option proto 'static'
	option ipaddr '192.168.13.8'
	option netmask '255.255.255.0'
	option ip6assign '60'
	option gateway '192.168.13.1'
	list dns '192.168.13.1'

config interface 'wan'
	option proto 'dhcp'
	option auto '0'

config interface 'wan6'
	option proto 'dhcpv6'
	option reqaddress 'try'
	option reqprefix 'auto'
	option norelease '1'
	option auto '0'

config bridge-vlan
	option device 'br-lan'
	option vlan '2'
	list ports 'lan3'
	list ports 'wan:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '4'
	list ports 'lan2'
	list ports 'wan:t'

config bridge-vlan
	option device 'br-lan'
	option vlan '13'
	list ports 'lan1:u*'
	list ports 'wan:t'

config interface 'vlan2'
	option proto 'none'
	option device 'br-vlan2'

config interface 'vlan4'
	option proto 'none'
	option device 'br-vlan4'

config bridge-vlan
	option device 'br-lan'
	option vlan '1'
	list ports 'wan:t*'

config interface 'vlan1'
	option proto 'none'
	option device 'br-vlan1'

config device
	option type 'bridge'
	option name 'br-vlan1'
	list ports 'br-lan.1'

config device
	option type 'bridge'
	option name 'br-vlan2'
	list ports 'br-lan.2'

config device
	option type 'bridge'
	option name 'br-vlan4'
	list ports 'br-lan.4'

/etc/config/wireless

config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc@0/c000000.wifi'
	option band '5g'
	option channel 'auto'
	option htmode 'HE80'
	option cell_density '1'
	option country 'DE'

config wifi-iface 'default_radio0'
	option device 'radio0'
	option mode 'ap'
	option ssid 'ssid'
	option encryption 'wpa2'
	option wpa_disable_eapol_key_retries '1'
	option auth_server '192.168.13.1'
	option auth_secret ''
	option acct_server '192.168.13.1'
	option acct_secret ''
	option dynamic_vlan '2'
	option vlan_tagged_interface 'br-lan'
	option vlan_bridge 'br-vlan'
	option vlan_naming '1'

Any ideas?

(ipq807x, qualcommax)

[passibe15]

For qualcommax this is not yet supported in the prebuilt images. See here (and here, too, maybe).

You'll have to build your own image with the patch from the pull request. Should work flawlessly then.
I haven't looked at your config files in detail, but usually you just need to create an interface for the specific VLAN and then in /etc/config/wireless just set this and then this.

[m.kuss]

Thanks a lot! I could build a custom image with the proposed patch and now it works.

Now the vlanX interfaces (unmanaged) are "connected" directly to the VLAN devices (bridge-vlan) created by the "bridge VLAN filtering". Enclosed the updated config files.

/etc/config/network

config interface 'loopback'
option device 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'

config globals 'globals'
option ula_prefix 'fdde:24ae:ce5f::/48'
option packet_steering '1'

config device
option name 'br-lan'
option type 'bridge'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'wan'

config interface 'lan'
option device 'br-lan.13'
option proto 'static'
option ipaddr '192.168.13.8'
option netmask '255.255.255.0'
option ip6assign '60'
option gateway '192.168.13.1'
list dns '192.168.13.1'

config interface 'wan'
option proto 'dhcp'
option auto '0'

config interface 'wan6'
option proto 'dhcpv6'
option reqaddress 'try'
option reqprefix 'auto'
option norelease '1'
option auto '0'

config bridge-vlan
option device 'br-lan'
option vlan '2'
list ports 'wan:t'

config bridge-vlan
option device 'br-lan'
option vlan '4'
list ports 'lan1'
list ports 'lan2'
list ports 'lan3'
list ports 'wan:t'

config bridge-vlan
option device 'br-lan'
option vlan '13'
list ports 'wan:t'

config interface 'vlan2'
option proto 'none'
option device 'br-lan.2'

config interface 'vlan4'
option proto 'none'
option device 'br-lan.4'

...

/etc/config/wireless

config wifi-device 'radio0'
option type 'mac80211'
option path 'platform/soc@0/c000000.wifi'
option band '5g'
option channel '52'
option htmode 'HE80'
option cell_density '1'
option country 'DE'

config wifi-iface 'default_radio0'
option device 'radio0'
option mode 'ap'
option ssid 'ssid'
option encryption 'wpa2'
option wpa_disable_eapol_key_retries '1'
option auth_server '192.168.13.1'
option auth_secret ''
option acct_server '192.168.13.1'
option acct_secret ''
option dynamic_vlan '2'

...

config wifi-vlan
option device 'default_radio0'
option network 'vlan2'
option vid '2'
option name '2'

config wifi-vlan
option device 'default_radio0'
option network 'vlan4'
option vid '4'
option name '4'

config wifi-vlan
option device 'default_radio0'
option network 'vlan5'
option vid '5'
option name '5'

...