Skip to content

Connecting a Ruckus AP to a Cisco Switch

Getting a Ruckus AP onto a Catalyst port so it has management access, carries its SSID VLANs, and draws full PoE+ power. Example: an R650 on a Catalyst 3560-CX, but the pattern is the same for any Ruckus AP on any Catalyst.

Two things here are non-obvious and both fail quietly — the AP works either way, just wrongly. They're covered in The Port is a Trunk and PoE: LLDP or You Get Half Power.

The Port is a Trunk

An AP is not an access-port device. It needs:

  • its own management traffic, untagged — so the AP appears on the management VLAN and the controller can find it
  • each SSID's VLAN, tagged — so client traffic lands in the right network

That is exactly a trunk with a native VLAN. Configure it as one:

Cisco IOS — interface configuration:

interface Gi0/11
 description Ruckus-R650-1
 switchport trunk native vlan 10
 switchport trunk allowed vlan 10,30
 switchport mode trunk
 spanning-tree portfast edge trunk
  • native vlan 10 — the AP's own management VLAN, untagged. This must match the VLAN the controller lives on.
  • allowed vlan 10,30 — 10 for management, 30 for the SSID. The native VLAN must appear in the allowed list, or its traffic is dropped and the AP goes unmanageable while still serving clients. See VLANs — Editing a Trunk's Allowed List.
  • portfast edge trunk — the trunk form of PortFast. Without it the port sits ~30 s in spanning-tree listening/learning on every boot, and the AP's DHCP request is dropped in that window. The plain portfast edge form does not apply to a trunk port.

IOS prints %Warning: portfast should only be enabled on ports connected to a single host. That is expected and correct here — a single AP is exactly the case PortFast is for.

Do not add BPDU Guard to an AP trunk. It belongs on user-facing access ports; on an AP port a mesh or bridged AP can legitimately emit BPDUs and err-disable itself.

PoE: LLDP or You Get Half Power

Ruckus APs request power over LLDP-MED. They do not speak CDP. Cisco switches ship with LLDP disabled and CDP enabled.

The result is a silent downgrade: with LLDP off, the AP has no way to ask for more than the default, so it takes 15.4 W (802.3af) and runs in reduced mode — the second Ethernet port and USB disabled, and less transmit headroom. Nothing errors. The switch reports the port as on. The AP works. It is simply at half power.

Enable LLDP globally, then bounce the port so negotiation happens at link-up:

Cisco IOS — global configuration:

lldp run

interface Gi0/11
 shutdown
 no shutdown

The bounce matters: power is negotiated when the link comes up, so enabling LLDP under an already-running AP changes nothing until the link is re-made.

Verify it actually negotiated

Cisco IOS — privileged EXEC:

show power inline Gi0/11 detail

The lines that matter:

Power Negotiation Used:  IEEE 802.3at LLDP
  Power Type:          Type 2 PSE           Type 2 PD
  Requested Power(W):  25.0                 25.0
  Allocated Power(W):  25.0                 25.0

Type 2 at both ends is 802.3at. Type 1 means you are still on af.

If both ends report Type 2 but the allocation is still 15.4W, LLDP is working and the remaining cap is the port's classification — see Two-Event Classification.

Read the right number. The summary view's watts figure is the reservation, not consumption — a port showing 29.5 W may be drawing 7.5 W. Actual draw is Measured at the port in the detail output. An idle AP drawing single-digit watts on a 30 W allocation is normal.

Confirm the AP agrees: in Unleashed, the AP's PoE Operating Mode should read 802.3at. It caches this from boot, so refresh the page — and if it still shows af, reboot the AP once from the controller.

Full Sequence

1. Switch — enable LLDP once per switch:

conf t
lldp run
end

2. Switch — the AP port:

conf t
interface Gi0/11
 description Ruckus-R650-1
 switchport trunk native vlan 10
 switchport trunk allowed vlan 10,30
 switchport mode trunk
 spanning-tree portfast edge trunk
 power inline auto
end
copy running-config startup-config

3. Plug the AP in, then verify:

! AP visible to the switch — capability should include (W) WLAN Access Point
show lldp neighbors

! Type 2 both ends
show power inline Gi0/11 detail

! Port up, mode trunk
show interfaces status

Troubleshooting

Symptom Cause Fix
AP powers on but never appears in the controller Native VLAN wrong, or native not in the allowed list Native must be the management VLAN and be present in allowed vlan
AP reachable, clients get no address SSID's VLAN missing from the allowed list Add it: switchport trunk allowed vlan add 30
Unleashed reports 802.3af LLDP disabled on the switch, or the port wasn't bounced after enabling it lldp run, then shutdown / no shutdown on the port
show lldp neighbors empty LLDP not running, or the AP has only just booted show lldp to confirm it's enabled; allow ~30 s for discovery
AP takes ~30 s to come online each boot PortFast missing, or the access-port form used on a trunk spanning-tree portfast edge trunk
Port err-disables when the AP connects BPDU Guard on an AP port Remove it — it belongs on user access ports
Power shows on but the AP is underpowered Reading the reservation, not the draw Check Measured at the port in show power inline … detail