Cisco Aironet 1231G and 1220B

I recently purchased a Cisco Aironet 1231G and a 1220B from eBay. The 1220B turned out to have been upgraded to a wireless G radio module. I have two Cisco access points that are G capable!

The 1231G was in Lightweight Access Point mode when I received it, and I followed Cisco's instructions to change it into an autonomous access point.

Configuring the APs isn't so straightforward if you've never worked with Cisco Aironet equipment. First you have to configure an SSID, then you have to attach the SSID to the radio module, and then you have to deal with encryption and authentication.

Authentication is specified in the SSID configuration, and the encryption is specified in the radio module configuration.

When everything was configured, I tried to search for the SSID, but it didn't appear. That was because I didn't put the SSID into guest-mode. By default, an SSID will not broadcast a beacon unless you add the guest-mode command. There can only be one guest SSID per BSSID.

The BSSID or Basic SSID is the mac address of the access point's radio. Recent IOS versions allow up to 8 concurrent BSSIDs and up to 16 regular SSIDs.

Here's where it gets really interesting: Neither the Ethernet interface nor the Dot11Radio interface were assigned IP addresses. They were both assigned to a bridge-group. A bridge-group is used to specify which interfaces will be participating in Cisco's IRB. Integrated Routing and Bridging is a way to connect two interfaces at the layer 2 level. This is how an access point connects the clients to the AP's wired network. It doesn't place the clients on a separate subnet because it is forwarding layer 2 traffic - not layer 3 traffic.

When a wireless client sends a packet to the access point, the way in which the AP forwards the packet  is very similar to how a switch forwards traffic. However there is a difference between how a switch works, and what the AP is doing.

When a switch receives a frame, it looks at the source mac address. If the address is not in the mac-address-table, the switch adds it to the table. The switch then looks at the frame's destination mac address. If it is in the mac-address-table, the switch forwards the frame out the interface listed in the entry. If it is not in the mac-address-table, the switch floods the frame out every interface in the vlan, except for the port on which the frame was received.

An access point by default will not have a mac-address-table. It does not do a lookup for every frame received. Instead, it forwards the frame from one interface to the only other interface.

There is a scenario in which the AP doesn't merely forward the frame to the next interface.
You can assign each bridge-group a virtual interface, much like the interfaces we use to telnet into a switch. It is called a BVI, or a Bridge Virtual Interface. The IP address is assigned to the BVI, and bridge routing must be turned on. By default, on IOS 12.3(8)JA, the BVI is already there, and the bridge routing is configured. It can only be configured to route for bridge-group 1. When I tried switching it, IOS gave me an error.