Всем привет.

Задача:
Настроить AIR-AP1231G c управлением в отдельном vlan. Документацию читал тут: http://www.cisco.com/en/US/tech/tk722/tk809/technologies_con...
Рекомендуют (вкратце):
1) создать саб-интерфейсы в vlan-е управления для радио/езернет, перевести их в режим native (в этом случае они автоматически собираются в первую бридж-группу);
2) Указать IP управления на BVI1;
3) Создать BVIX в vlan-е, в котором будем гонять радио-траффик, создать саб-интерфейсы в в vlan-е X;
4) подготовить на каталисте интерфейс с vlan-ми управления и ssid, перевести vlan управления в режим native

Проблема:
Нет бегает траффик в vlan-е управления (точка доступа не пингается, не пускает по телнет, сама никого не пингает и т.д. и т.п.). С траффиком в vlan-е ssid все хорошо, клиенты ассоциируются, интернет у них работает.

мой конфиг + sh ver на АП:
!
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname AP1231G-SPB-TREX-SHOP
!
enable secret 5 <cut>
!
ip subnet-zero
ip domain name default.domain
!
!
aaa new-model
!
!
aaa authentication login default group tacacs+ enable
aaa authentication enable default group tacacs+ enable
aaa authorization exec default group tacacs+ if-authenticated
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 0 default stop-only group tacacs+
aaa accounting commands 2 default stop-only group tacacs+
aaa accounting commands 15 default stop-only group tacacs+
aaa session-id common
!
dot11 ssid OpenWiFi
   vlan 69
   authentication open
   guest-mode
!
!
!
!
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
ssid OpenWiFi
!
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
!
interface Dot11Radio0.11
encapsulation dot1Q 11 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface Dot11Radio0.69
encapsulation dot1Q 69
no ip route-cache
no cdp enable
bridge-group 69
bridge-group 69 subscriber-loop-control
bridge-group 69 block-unknown-source
no bridge-group 69 source-learning
no bridge-group 69 unicast-flooding
bridge-group 69 spanning-disabled
!
interface FastEthernet0
description "Uplink to C2950-24-SPB-TREX-SHOP int fa0/23"
no ip address
no ip route-cache
duplex auto
speed auto
hold-queue 160 in
!
interface FastEthernet0.11
encapsulation dot1Q 11 native
no ip redirects
no ip unreachables
no ip proxy-arp
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface FastEthernet0.69
encapsulation dot1Q 69
no ip route-cache
bridge-group 69
no bridge-group 69 source-learning
bridge-group 69 spanning-disabled
!
interface BVI1
ip address 172.17.100.161 255.255.255.0
no ip proxy-arp
no ip route-cache
!
no ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip tacacs source-interface BVI1
!
tacacs-server host 172.17.100.10 port 49 key 7 <cut>
tacacs-server directed-request
!
control-plane
!
bridge 1 route ip
bridge 69 protocol ieee
!
!
!
line con 0
line vty 0 4
!
end

#sh ver
Cisco IOS Software, C1200 Software (C1200-K9W7-M), Version 12.3(8)JA, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2006 by Cisco Systems, Inc.
Compiled Mon 27-Feb-06 09:09 by ssearch

ROM: Bootstrap program is C1200 boot loader
BOOTLDR: C1200 Boot Loader (C1200-BOOT-M) Version 12.2(8)JA, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)

AP1231G-SPB-TREX-SHOP uptime is 1 day, 7 hours, 24 minutes
System returned to ROM by reload
System image file is "flash:/c1200-k9w7-mx.123-8.JA/c1200-k9w7-mx.123-8.JA"

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco AIR-AP1231G-E-K9     (PowerPC405GP) processor (revision A0) with 15038K/1336K bytes of memory.
Processor board ID FOC08050JCJ
PowerPC405GP CPU at 196Mhz, revision number 0x00C4
Last reset from reload
1 FastEthernet interface
1 802.11 Radio(s)

32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:0F:24:52:BD:93
Part Number                          : 73-8704-06
PCA Assembly Number                  : 800-23211-07
PCA Revision Number                  : A0
PCB Serial Number                    : FOC08050JCJ
Top Assembly Part Number             : 800-23304-07
Top Assembly Serial Number           : FHK0805J40P
Top Revision Number                  : B0
Product/Model Number                 : AIR-AP1231G-E-K9

Configuration register is 0xF

Выше vlan управления - 11, vlan ssid - 69.

Каталист:
C2960-24-SPB-ITDEP#sh cdp ne fa0/23 de
-------------------------
Device ID: AP1231G-SPB-TREX-SHOP.default.domain
Entry address(es):
  IP address: 172.17.100.161
Platform: cisco AIR-AP1231G-E-K9    ,  Capabilities: Trans-Bridge
Interface: FastEthernet0/23,  Port ID (outgoing port): FastEthernet0
Holdtime : 128 sec

Version :
Cisco IOS Software, C1200 Software (C1200-K9W7-M), Version 12.3(8)JA, RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2006 by Cisco Systems, Inc.
Compiled Mon 27-Feb-06 09:09 by ssearch

advertisement version: 2
Duplex: full
Power drawn: 4.420 Watts
Management address(es):

C2960-24-SPB-ITDEP#sh run int fa0/23
Building configuration...

Current configuration : 127 bytes
!
interface FastEthernet0/23
switchport trunk native vlan 11
switchport trunk allowed vlan 11,69
switchport mode trunk
end

C2960-24-SPB-ITDEP#

C2960-24-SPB-ITDEP#sh vlan | i mgmt
11   mgmt                             active    
C2960-24-SPB-ITDEP#

C2960-24-SPB-ITDEP#sh vtp status
VTP Version                     : 2
Configuration Revision          : 26
Maximum VLANs supported locally : 255
Number of existing VLANs        : 12
VTP Operating Mode              : Server
VTP Domain Name                 : axis-vtp
VTP Pruning Mode                : Disabled
VTP V2 Mode                     : Disabled
VTP Traps Generation            : Disabled
MD5 digest                      : 0xE5 0x6D 0x4B 0xFA 0x99 0x29 0x69 0x5D
Configuration last modified by 172.17.100.154 at 9-5-11 10:10:47
Local updater ID is 172.17.100.152 on interface Vl11 (preferred interface)
Preferred interface name is vl11  
C2960-24-SPB-ITDEP#

Теперь симптомы:
AP1231G-SPB-TREX-SHOP#ping 172.17.100.1

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.17.100.1, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
AP1231G-SPB-TREX-SHOP#ping 172.17.100.10

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.17.100.10, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
AP1231G-SPB-TREX-SHOP#ping 172.17.100.152

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.17.100.152, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
AP1231G-SPB-TREX-SHOP#ping 172.17.100.160

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.17.100.160, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)
AP1231G-SPB-TREX-SHOP#
При том, что:
AP1231G-SPB-TREX-SHOP#sh ip arp bvi1
Protocol  Address          Age (min)  Hardware Addr   Type   Interface
Internet  172.17.100.152          2   001d.712a.6e41  ARPA   BVI1
Internet  172.17.100.161          -   000f.2452.bd93  ARPA   BVI1
Internet  172.17.100.160         57   0016.c87e.6d80  ARPA   BVI1
Internet  172.17.100.10           1   0001.032a.1196  ARPA   BVI1
Internet  172.17.100.1          107   001c.5879.17cf  ARPA   BVI1
AP1231G-SPB-TREX-SHOP#
Предупреждая вопросы об acl-ях:
AP1231G-SPB-TREX-SHOP#sh ip access-lists
Extended IP access list sl_def_acl
    10 deny tcp any any eq telnet log
    20 deny tcp any any eq www log
    30 deny tcp any any eq 22 log
    40 permit ip any any log
AP1231G-SPB-TREX-SHOP#
Удалить этот acl не удается, однако сам по себе он нигде не применен (видно из конфигурации)

Есть у кого-нибудь идеи что с этим делать? Спрашиваю потому, что у самого идеи кончились =((