I currently have 3 5548s in 3 separate closets. As we established in an earlier post, I need to run a LAG between Closet 1 and 2 and then a separate LAG between closet 2 and 3.

Now comes the difficulty. I need to have 2 VLANs. VLAN 1 will handle our internal LAN traffic. VLAN 2 will handle traffic for a guest wifi network and will haul back to the internet demarc. Each switch will have one port that goes to a wifi AP. The wifi AP tags packets so that SSID 1 can be on VLAN 1 and SSID 2 can be on VLAN 2. These VLANs need to span switches and travel across the LAGs. So what I have set up and is apparently wrong...

Switch 1 (I eliminated the QoS cruft from the top):

!
interface vlan 1
 ip address 192.168.15.23 255.255.255.0
!
interface vlan 2
 name "Wifi - Public"
!
interface gigabitethernet1/0/45      -----> Access to untagged devices on VLAN2
 switchport general allowed vlan add 2 tagged
 switchport access vlan 2
 switchport general pvid 2
!
interface gigabitethernet1/0/4  -----> Access to untagged devices on VLAN2 which would go to a router for public wifi access.

 switchport general allowed vlan add 2 tagged

 switchport access vlan 2

 switchport general pvid 2
!
interface gigabitethernet1/0/47                --->       LAG1 port 1
 channel-group 1 mode auto
!
interface gigabitethernet1/0/48       ---->  LAG1 port 2
 channel-group 1 mode auto
!
interface Port-channel1
 description LAG1
 switchport mode trunk
!
ip route 0.0.0.0 0.0.0.0 192.168.15.1

Switch 2

!
interface vlan 1
 ip address 192.168.15.24 255.255.255.0
!
interface vlan 2
 name "Wifi - Public"
!
interface gigabitethernet1/0/1   -----> Port receiving the tagged packets from the wifi AP
 switchport mode general
 switchport general allowed vlan add 1-2 tagged
 switchport general acceptable-frame-type tagged-only
 switchport general pvid 4095
!
interface gigabitethernet1/0/45  -----> Access to untagged devices on VLAN2

 switchport general allowed vlan add 2 tagged
 switchport general pvid 2
!
interface gigabitethernet1/0/46   -----> Access to untagged devices on VLAN2

                
 switchport general allowed vlan add 2 tagged
 switchport general pvid 2
!
interface gigabitethernet1/0/47
 channel-group 1 mode auto
!
interface gigabitethernet1/0/48
 channel-group 1 mode auto
!
interface Port-channel1
 description LAG1
 switchport mode trunk
!
ip route 0.0.0.0 0.0.0.0 192.168.15.1

I would expect SSID2 to be able to ping any device on ports 45 and 46 on either switch. Then SSID1 should be able to ping ports 2-44 on either switch (I figure switch 3 will be easy enough to rope in once I get this figure out on the first two). Hopefully this makes sense and someone call tell me where I have run amuck.

Thanks!