Network (Troubleshooting)

This page is intended for people debugging issues with the network. Ask Nick or Martin if there are problems. 

WiFi:

We currently have three WiFi APs. One in the office, in the cabinet with the switch, one in the bar, above and to the right of the door from the foyer, and, one in Studio 1, above the front row of the balcony in the middle. There used to be one in Studio 2 as well. All are Ruckus ZoneFlex R300 APs. 

All the APs are managed by a Ruckus ZoneDirector run by Optimity on their network. If the Optimity router is not reachable (usually on IP 10.11.13.1 on the Optimity network), this will probably not be reachable, eventually causing problems for the APs. 

The APs are powered using PoE from the main switch so, disconnecting the cables will cut power to them. 

The APs provide two WiFi networks (SSIDs): 'Arcola' and, 'Arcola_Private'. Traffic from the 'Arcola' SSID is sent untagged, traffic from the 'Arcola_Private' SSID is sent tagged with VLAN tag 5. The tags are used by the switch to determine which ports can be destinations for the traffic. Untagged traffic from the APs is connected to VLAN 2 in the switch. Traffic tagged with ID 5 is connected to VLAN 5 (this is determined by the switch config for the ports they are connected to). 

The APs get an IP address on the public network (VLAN 2 in the switch) and respond to pings. They usually get IPs 

• 10.11.13.2 for the office, 

• 10.11.13.3 for the bar and 

• 10.11.13.4 for Studio 1 

but, as the DHCP server on the public network (VLAN 2 in the switch) is being run by Optimity, this could change. Their MAC addresses are  

• D4:68:4D:28:51:60 for the office, 

• D4:68:4D:28:29:B0 for the bar and 

• D4:68:4D:28:52:00 for Studio 1. 

The BSSIDs on the 'Arcola' network are D4:68:4D:28:51:68 (2.4GHz) and D4:68:4D:28:51:6C (5GHz) for the office, D4:68:4D:28:29:B8 (2.4GHz) and D4:68:4D:28:29:BC (5GHz) for the bar, and, D4:68:4D:28:52:08 (2GHz) and D4:68:4D:28:52:0C (5GHz) for Studio 1. 

The BSSIDs on the 'Arcola_Private' network are D4:68:4D:68:51:68 (2.4GHz) and D4:68:4D:68:51:6C (5GHz) for the office, D4:68:4D:68:29:B8 (2.4GHz) and D4:68:4D:68:29:BC (5GHz) for the bar, and, D4:68:4D:68:52:08 (2GHz) and D4:68:4D:68:52:0C (5GHz) for Studio 1. 

The APs are connected to port 4 on the switch for the office AP, port 5 for the bar AP and port 6 for the Studio 1 AP. This can be checked using the dynamic address table in the switch looking for their MAC addresses (filter for VLAN 2). 

VLANs:

To debug problems with the network, it is often useful to be able to connect to multiple VLANs. Do not simply bridge them with a cable or, by bridging two (virtual) interfaces on a device as this will connect different broadcast domains and allow a DHCP server on one to answer queries from clients on another, leading to misconfigured clients and chaos. 

To create a virtual interface that tags traffic and receives tagged traffic on Linux, run sudo ip link add link <real_interface_name> name <name> type vlan id <id> where <real_interface_name> is the name of the real underlying interface receiving the traffic (e.g. eth0, enp0s1 etc), <name> is the name of the new virtual interface (you can choose this but, something like eth0.5 for VLAN ID 5 on eth0 would be a conventional name), <id> is the VLAN tag ID (e.g. 5 or 2) (e.g. sudo ip link add link eth0 name eth0.2 type vlan id 2). Once the link is created, the DHCP client can be run to get an IP address and gateway by DHCP by running e.g. sudo dhclient eth0.5 or, the IP address and netmask can be configured manually with e.g. sudo ifconfig eth0.1 up 192.168.0.45/24 (giving IP address 192.168.0.45 and 24-bit netmask). The virtual interface can be destroyed by running sudo ip link del <name> where <name> is the name given to the virtual interface. To be able to receive traffic on a VLAN, it must be admitted by the switch tagged through the port the machine is connected to. Port 1 (which should be patched to the port that the switch on Nick's desk should be connected to) should be configured to be on VLAN 0 for untagged traffic and admit other traffic tagged. Since the remote login laptop is connected to the switch on Nick's desk, this should be able to connect to any VLAN like this (since the switch on Nick's desk should be configured to allow tagged traffic through any port for VLANs 1, 2, 3 and 5). VLAN 3 is used to connect the Draytek router to the Virgin router, via the switch. VLAN 5 ('Arcola_Private' SSID) is connected to the Draytek router via a port on the switch, which is in tern configured for this to be a separate VLAN and to give IP addresses in the 192.168.2.0/24 range for this network but, it is configured to route traffic between this and the main wired network connected to it which gets IPs in the 192.168.7.0/24 range. 

There is a limited number of IP addresses in the pool available to be given out for the DHCP servers for both networks, which is less than 256 (some addresses are reserved on both DHCP servers). The Optimity DHCP server is not controlled by us but, the configuration for the one for VLAN 5 ('Arcola_Private') is available on the Draytek router (see LAN 2 config).

Ports:

That need to be open for PointOne (and VPNs in general):

TCP/UDP

5900 - RFB (“remote framebuffer”) = remote access to GUIs, used in Virtual Network Computing (VNC)

1433 - SQL Server

3389 - Remote Desktop Protocol (RDP)

1723 - Point-to-Point Tunneling Protocol (PPTP) for VPNs

47 - IP Protocol Number, not a port (should close)

443 - SSL

Also PointOne keeps our public IP on record, so if it changes, this all may break until we tell them our new public IP (82.43.222.83 as of 29/11/2016).

Immediate Theatre:

5000 needs to be forwarded for Immediate Theatre to their server, 192.168.7.249