I found this particularly annoying issue with some new Cisco 1141N Wireless Access Points.
The problem is that you want to use "Bridge-Group 1" for your management of the WAP and you want to assign Bridge-Group 1 to a sub-interface.
The default config looks something like this
interface Dot11Radio0
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
interface GigabitEthernet0 no ip route-cache bridge-group 1 no bridge-group 1 source-learning bridge-group 1 spanning-disabled
No matter what you do, you can not take "bridge-group 1" off of either of these interfaces using the standard "no bridge-group 1 command" as you would expect. I was configuring one Wireless access point and somehow managed to get it off but had made so many changes by the time I'd realised I had resolved it, that I couldn't figure out what I had done to get it off the blasted thing! Always track your changes and observe the results!Eventually I figured it out and found another guy with the same problem.So my Posts from http://packetlife.net/blog/2012/feb/20/aironet-aps-bridge-groups-and-bvi/ :Cameron (guest) commented on Monday, July 16, 2012 at 8:52 p.m. UTCI'm curious as to what hardware this was configured on. I'm trying replicate these steps on my Aironet 1141n but cannot setup the bridge groups the same way. The Dot11Radio0 is in bridge-group 1 by default and cannot be removed. This means when I go to configure Dot11Radio0.10, I cannot add the bridge group 1 like you did in the example. Should I just move to the next bridge group?PACETREE (guest) commented on Monday, October 29, 2012 at 2:05 p.m. UTCI ran into the same problem trying to remove bridge group 1 from my 1141N. You need to add the physical interfaces to another bridge group (i.e. overwrite the bridge group on the physical interfaces) and then you are free to use bridge-group 1 on a subinterface which you will need to do if one of your sub-interfaces is going to be your management interface (and int BVI1 having a IP address in this network)"Next we need to remove initially configured “bridge-group 1” on physical interfaces FastEthernet0 dot11Radio0 and dot11Radio1 because we will use their subinterfaces. We cannot remove “bridge-group 1” directly. It does not allow us to do this. It likes “bridge-group 1” probably because it is necessary to existence of BVI1-interface. But we can assign “bridge-group 2” to interface and then remove it yet. Just look at that: ap-1131.sokol.msk#configure terminal Enter configuration commands, one per line. End with CNTL/Z. ap-1131.sokol.msk(config)#interface FastEthernet0 ap-1131.sokol.msk(config-if)#no bridge-group 1 %command not allowed, cannot remove bridge-group 1 ap-1131.sokol.msk(config-if)#bridge-group 2 ap-1131.sokol.msk(config-if)#no bridge-group 2 Feb 13 19:14:29: %LINK-3-UPDOWN: Interface BVI1, changed state to down Feb 13 19:14:30: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to down ap-1131.sokol.msk(config-if)#do show running-config interface FastEthernet 0 Building configuration...Current configuration : 90 bytes ! interface FastEthernet0 no ip address no ip route-cache duplex auto speed auto endap-1131.sokol.msk(config-if)#interface dot11Radio0 ap-1131.sokol.msk(config-if)#bridge-group 2 ap-1131.sokol.msk(config-if)#no bridge-group 2 ap-1131.sokol.msk(config-if)#interface dot11Radio1 ap-1131.sokol.msk(config-if)#bridge-group 2 ap-1131.sokol.msk(config-if)#no bridge-group 2 ap-1131.sokol.msk(config-if)#end