topic Re: Catalyst 9800 dhcp issue in Wireless

Catalyst 9800 dhcp issue

stefxoxo — Mon, 12 Jul 2021 17:36:32 GMT

Hi,

Our deployment is currently composed by:

- Catalyst 9800-40 release Amsterdam 17.3.3 (upgrade performed from the default version 16.12.02s) - Access Point 9120AX

We are not allowed to configure the helper address on the Gateway (Firewall Checkpoint).

During the test phase the following problem has been checked: issue with the IP release for the Clients connected to the new AP 9120 AX in local mode (no flexconnect central switching/local).

We configure :

Interface vlan 222

description management_plane

ip address y.y.y.y

interface vlan 111

description dataplane

ip address x.x.x.x

ip helper-address x.x.x.x

ip dhcp relay source-interface vlan 222

ip route 0.0.0.0 0.0.0.0 y.y.y.1

Do we have to configure something else ? the client don't receive the ip address .

Thank you

Re: Catalyst 9800 dhcp issue

balaji.bandi — Mon, 12 Jul 2021 18:54:24 GMT

First, i would check is the DHCP Server reachable using VLAN 222?

Re: Catalyst 9800 dhcp issue

.Jaidev Hattiangadi. — Tue, 13 Jul 2021 06:15:27 GMT

Check at what stage of DHCP are the clients in. Does the DISCOVER go through? if yes, are the OFFERs coming in?

Then check if the server is even getting the DISCOVERs

Cheers!

Re: Catalyst 9800 dhcp issue

stefxoxo — Tue, 13 Jul 2021 06:31:49 GMT

Hi,

the dhcp is pingable from the vlan 222, the firewall do not drop the dhcp request. Yes the discover go through, but we do not have the response back from the dhcp. We need to define option 82 ?

Us i told we can't configure the ip helper address on the DG, and we try to set the helper on the wlc. This configuration is not well documented from cisco.

Thx

Re: Catalyst 9800 dhcp issue

Rich R — Tue, 13 Jul 2021 16:37:14 GMT

We are using ip helper-address on the client vlan interface and it's working.

Just remember this is effectively an IOS-XE router now so the traffic must be able to route both ways, which also means you need the right security (ACLs) in place. Note this is not the Cisco recommended approach (they'd rather you do that on the next hop switch/router) but it works.

Note we are *not* using ip dhcp relay source-interface because when the packet is routed to the DHCP server out of your vlan 222 (following the routing table) it will pick up the outgoing interface IP by default.

Try without the relay source-interface command?

And do packet captures on the DHCP server and the 9800 (vl222) to see what is getting sent and received on each so you'll quickly see where it's getting lost.

Re: Catalyst 9800 dhcp issue

stefxoxo — Wed, 14 Jul 2021 06:01:54 GMT

We tested with and without ip dhcp relay source xx, we tested with vrf and static route on data vlan but the documentation say that is not supported.

Maybe this is a bug or we forgot some commands. With a static IP all works.

Last things to do is a packet capture..the dhcp is a MS server

How is it possible that i'm the only one who found this problem ? The old wlc (aireos)work perfecly on the same vlan !!

maybe there is a problem with the dhcp proxy feature...

Thx all

Re: Catalyst 9800 dhcp issue

stefxoxo — Wed, 14 Jul 2021 07:10:35 GMT

We try to set the ip add dhcp on the svi and we received this error:

CAT9800(config-if)#%Unknown DHCP problem.. No allocation possible
Jul 14 07:08:45.117: DHCP: Waiting for 5 seconds on interface Vlan111

tHX

Re: Catalyst 9800 dhcp issue

stefxoxo — Wed, 14 Jul 2021 07:12:11 GMT

We try to set ip add dhcp on the svi and we received the following error

wlc(config-if)#%Unknown DHCP problem.. No allocation possible
Jul 14 07:08:45.117: DHCP: Waiting for 5 seconds on interface Vlan111

Thx

Re: Catalyst 9800 dhcp issue

Rich R — Wed, 14 Jul 2021 08:20:47 GMT

Why would you do that? I Wouldn't expect that to work at all. That's only for obtaining an IP from a DHCP server on the connected interface! The interface must have a static Ip to be able to relay.

Like I already said it *does* work. We have it working on 17.5.1 so maybe try that version.

> The old wlc (aireos)work perfecly on the same vlan !! maybe there is a problem with the dhcp proxy feature...

This is a completely new operating system and some things (like this) work differently so you have to redesign. AireOS proxied (and relayed) the DHCP, IOS-XE does not. Like it or not you need to make it work with the new approach. There is no DHCP proxy feature on the 9800 WLC.

Re: Catalyst 9800 dhcp issue

stefxoxo — Wed, 14 Jul 2021 08:58:55 GMT

from cisco document the dhcp proxy is supported on cat9800. or this doc is wrong....

Re: Catalyst 9800 dhcp issue

stefxoxo — Wed, 14 Jul 2021 09:09:12 GMT

From the release notes the 17.5.1 seems that do not support AP 2700, for us this is a problem...

Thx

Re: Catalyst 9800 dhcp issue

stefxoxo — Wed, 14 Jul 2021 10:04:05 GMT

from the relase notes of 17.5.1 ...

Dhcp relay behaviour

This feature aligns the setting of DHCP relay parameters, such as, Gateway IP address, Option 82, and DHCP server address with the Cisco AireOS behaviour.

Re: Catalyst 9800 dhcp issue

Rich R — Wed, 14 Jul 2021 11:21:02 GMT

I may be wrong about the proxy feature or somebody has confused proxy and relay as being the same ...

Only way to be sure is open a TAC case and get TAC to query with the BU.

If it's a mistake in the doc then they'll fix the doc not the code.

Re: Catalyst 9800 dhcp issue

Rich R — Wed, 14 Jul 2021 11:21:45 GMT

But the routing is still different to the way AireOS works.

Re: Catalyst 9800 dhcp issue

Rich R — Wed, 14 Jul 2021 11:26:19 GMT

It was always made clear that the AC Wave 1 APs (including 2700) would have limited support on 9800. That's because of their end of life dates and we've all had plenty of time to prepare for that: https://www.cisco.com/c/en/us/products/collateral/wireless/aironet-2700-series-access-point/eos-eol-notice-c51-740711.html

"End of SW Maintenance Releases Date HW: The last date that Cisco Engineering may release any final software maintenance releases or bug fixes. After this date, Cisco Engineering will no longer develop, repair, maintain, or test the product software. April 29, 2020"

Re: Catalyst 9800 dhcp issue

Arshad Safrulla — Wed, 14 Jul 2021 23:01:23 GMT

You can configure the DHCP relay in the Checkpoint firewall, it is supported for a very long time in checkpoints.

remove all DHCP related configuration from the WLC and only configure the dhcp relay in the firewall, client DHCP traffic gets bridged at the controller in the client VLAN mapped to the SSID. So no need for any relays or helpers in WLC

Re: Catalyst 9800 dhcp issue

stefxoxo — Thu, 15 Jul 2021 05:58:28 GMT

Yes, this can be a solution but at the moment us i told is not possible (from the customer).

We will try the 17.5 release that use the same behavior of the aireos.

Thx Stef

Re: Catalyst 9800 dhcp issue

Arshad Safrulla — Thu, 15 Jul 2021 14:23:10 GMT

Can you add the command ip routing, when you enable ip helper address it is compulsory to have routing.

Re: Catalyst 9800 dhcp issue

stefxoxo — Thu, 15 Jul 2021 16:04:22 GMT

Tested with release 17.5 and do not work !! yes ip routing is enabled.

The dhcp request go out from the management interface, and the dhcp is not able to allocate the ip.

The behaviour is not ported on the new cat98

Re: Catalyst 9800 dhcp issue

Rich R — Thu, 15 Jul 2021 16:23:45 GMT

I already told you:

- It's not the same as AireOS - having trantrums will not change that. If you want to use 9800 then learn to work with the 9800 design.

- It does work - we have it working with live customers in service.

So get packet captures on 9800 and DHCP server, get debugs/logs on your DHCP server, check them and work out why it is not working then fix the cause. Very likely a config error somewhere on 9800 or DHCP server.