topic Re: Cisco 9800-L -Client static IP Assignment not routing in Wireless

Cisco 9800-L -Client static IP Assignment not routing

sejamc71 — Wed, 19 Apr 2023 14:32:29 GMT

We just deployed an HA pair of 9800-L WLCs. Ran into a weird issue. DHCP seems to be working as well as Static IP assignment, from 1 VLan, but static IPs from the other VLans are not. See below for the Tshooting steps I've completed. Worked with Cisco TAC for 4 hours yesterday and they were at a Loss. Resuming today, but wanted to present this to you folks and see if you've seen this before. I have verified that the Wireless VLans 66, 68 and 70 are configured exactly the same as VLan 64 on both the switch and the WLC. Thoughts?

Re: Cisco 9800-L -Client static IP Assignment not routing

Scott Fella — Wed, 19 Apr 2023 14:45:46 GMT

First off, did you test with a wired laptop on the same switch the controllers are connected to? This will at least validate that everything is working on the wired side. One the wireless, you just have to make sure that DHCP required is not enabled on the wlan, but I would think TAC would have reviewed that.

Have you tried Mac reservations to see what the device obtains? Verify that the gateway, subnet and dns servers are the same when you configure the static?

Validate step 4

Configuring the Internal DHCP Server Under a Wireless Policy Profile (GUI)

Procedure

Step 1	Choose Configuration > Tags & Profiles > Policy.
Step 2	Click a policy name.
Step 3	Click the Advanced tab.
Step 4	Under DHCP settings, check or uncheck the IPv4 DHCP Required check box and enter the DHCP Server IP Address.
Step 5	Click Update & Apply to Device.

Re: Cisco 9800-L -Client static IP Assignment not routing

sejamc71 — Wed, 19 Apr 2023 14:47:02 GMT

I tested with a wired/wireless laptop and routing is functioning as expected. 1 IP, assigned to the Hardware NIC works and that same IP assigned to the Wireless NIC does not. I do have a MAC filter network, but am getting the same results. It connects, says "No Internet" and is not able to access resources. I am looking for the DHCP required setting now, but haven't found it as of yet. Still going through the WLC though.

Re: Cisco 9800-L -Client static IP Assignment not routing

sejamc71 — Wed, 19 Apr 2023 14:50:54 GMT

I see the IPv4 DHCP Required option, but it doesn't appear to be selected.

Re: Cisco 9800-L -Client static IP Assignment not routing

Scott Fella — Wed, 19 Apr 2023 14:54:33 GMT

Well when you get "No Internet", that means you have a network connection, but either the gateway/subnet is wrong or DNS. You validate your NAT settings for that subnet for internet?

Re: Cisco 9800-L -Client static IP Assignment not routing

Scott Fella — Wed, 19 Apr 2023 15:03:34 GMT

How is everything setup? Local switching, flex connect?

Re: Cisco 9800-L -Client static IP Assignment not routing

sejamc71 — Wed, 19 Apr 2023 15:03:55 GMT

I've checked all of the VLans on the WLC and all of the gateways and subnet masks are correct. If the IP is dhcp assigned, it works fine, but if it is statically assigned it doesn't. From the WLC Trouble Shooting page, I can, from the WLC, ping the gateways of each of the VLans and Traceroute to the core switch. If I take that Wireless IP and assign a physical switch port to that vlan, I am able to get to the internet just fine. If the IP is doled out via dhcp on the WLC, I can get to the internet fine, indicating that the gateways and masks are correct. The problem only exists on a Static assignment.

Re: Cisco 9800-L -Client static IP Assignment not routing

sejamc71 — Wed, 19 Apr 2023 15:04:54 GMT

We have a mix. The remote sites are setup in Flex mode and are functioning normally. The local APs are in Local mode and are working fine with DHCP IPs

Re: Cisco 9800-L -Client static IP Assignment not routing

Scott Fella — Wed, 19 Apr 2023 15:40:37 GMT

The only work-around you have right now is to reserve the Mac address and just do DHCP. I just tested my setup on FlexConnect and assigned my iPhone a static with no issues at all. You have a 9800 in a lab you can test with?

Re: Cisco 9800-L -Client static IP Assignment not routing

Rich R — Thu, 20 Apr 2023 17:47:25 GMT

You haven't fully described your setup - are you trying to use all those vlans in a group on a single WLAN?
If so then trying to force static IPs the way you are is not supported.

Also what version of software are you using? Refer to TAC recommended versions below.

Re: Cisco 9800-L -Client static IP Assignment not routing

sejamc71 — Thu, 20 Apr 2023 19:47:48 GMT

We are running a pair of 9800-L in an Active/Standby config. Remote offices are all set to Flex and the local Office APs are in Local mode. We have 3 Wireless subnets locally. Employee wireless and a Mac Filtering WLan are pointed at a VLan group for dhcp traffic and that all seems to be working perfectly. There are some Oracle printers and stuff that HAVE to have a static IP. Static IPs are pulled from a DHCP exclusion list and assigned to the devices. DHCP and Static IPs from VLan 64 are working fine. DHCP from VLans 66 and 68 are working fine. Static IPs from VLan 66 and 68 are not working. All subnets exists on the same core switches, all SVIs on the WLC and VLans are built exactly the same but when you assign a static from 66 or 68 on the printer or even a test laptop, you can't ping the gateway of the subnet and you can't get on the network. Cisco TAC said they were stumped and I've been working with them for 2 days. I'm not sure they are looking at the right component.

Re: Cisco 9800-L -Client static IP Assignment not routing

Scott Fella — Thu, 20 Apr 2023 22:24:36 GMT

So... you mentioned vlan group... vlan group is not defined for vlan 66 or 68 correct, because vlan group does not support static address.

Re: Cisco 9800-L -Client static IP Assignment not routing

sejamc71 — Thu, 20 Apr 2023 23:19:47 GMT

VLans are created and we DO HAVE a Vlan Group defined which includes Vlan 64, 66, 68, and 70. On the 5508, you have the ability to specify an IP address when you add a device to MAC Filtering. We had a Cisco Consultant build the basic config for the new controller and on the new 9800s, there is an "Attribute" field which you can define that is supposed to direct the the group to a specific VLan per device.

Re: Cisco 9800-L -Client static IP Assignment not routing

Scott Fella — Fri, 21 Apr 2023 00:09:50 GMT

There are other post on the forum regarding vlan groups and static address not working. Its also stated in the configuration guide. It works on AireOS, but not on the 9800's.

Re: Cisco 9800-L -Client static IP Assignment not routing

sejamc71 — Fri, 21 Apr 2023 00:29:56 GMT

It was decided that a Cisco Consultant should build out the new controllers as part of the project. I'm guessing that was money well spent.

Re: Cisco 9800-L -Client static IP Assignment not routing

Scott Fella — Fri, 21 Apr 2023 04:18:57 GMT

Well it really also comes down to what were the requirements and if the consultant knew that there were going to be static address involved. I’m not going to assume anything, but when I was a consultant, I gathered the requirements, called out the risk, and built a test plan that the customer agreed on. See what was discussed as part of the requirements.

Re: Cisco 9800-L -Client static IP Assignment not routing

Rich R — Fri, 21 Apr 2023 07:38:58 GMT

Yes TAC should have told you that. But lately we've found we know way more about Cisco products and configuration than many of first line TAC staff (especially those with emails ending in -X), having to explain and teach them real basic stuff about Cisco products before they can even start working on our cases.

So even in the latest config guide - Restrictions:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-1/config-guide/b_wl_17_11_cg/vlan-groups.html
"For the VLAN Groups feature to work as expected, the VLANs mapped in a group must be present in the controller. The static IP client behavior is not supported.)"

But from 17.9:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/release-notes/rn-17-9-9800.html#Cisco_Concept.dita_97e48d4d-09ea-4a81-ace5-f6e5a68bd4d8

VLAN Group to Support DHCP and Static IP Clients

The VLAN Group to Support DHCP and Static IP Clients feature aims to handle the network access of clients whose static IP address is not a part of the VLAN's IP list.

For more information, see the chapter VLAN Groups.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_conf_vlan_grp_vewlc.html#Cisco_Concept.dita_d6d44755-4647-4861-9f8e-beee1d58b6d1
" This feature only supports IPv4 clients and is enabled by default. However, ensure that the ipv4 dhcp required command is not configured on the wireless policy profile, because this disables the feature, causing the client to be stuck in the IP learn state." Also see the other prerequisites and restrictions for the feature.

So back to my earlier question, which you did not answer: What version of software are you running (you should ALWAYS provide this info because it matters)?

Re: Cisco 9800-L -Client static IP Assignment not routing

Rich R — Fri, 21 Apr 2023 07:42:14 GMT

Realistically speaking you should have a separate SSID with a single VLAN purely for your printers or just don't use VLAN groups. That will save you a whole lot of trouble.

Re: Cisco 9800-L -Client static IP Assignment not routing

sejamc71 — Fri, 21 Apr 2023 12:48:19 GMT

Agreed. 1 Vlan per bldg. I inherited most of this. We have 3 buildings side by side. The RF Guns and even printers will be moved by the employees to different buildings depending on work loads. This means the 4 vlans all have to work at all 3 of the bldgs. On the 5508 controllers, this worked flawlessly and apparently I am too naive to believe that Cisco would take away working functions. I may try to upgrade to 17.9 and see how that works out

Re: Cisco 9800-L -Client static IP Assignment not routing

Scott Fella — Fri, 21 Apr 2023 13:28:35 GMT

Everyone inherits things, but that makes the challenge better. You see what doesn't work or possible needs to change and you start planning. Fixing what is broke and making the user experience better is the key to being a good engineer. Inheriting "something" and leaving it like it is, is not going to make thinks better. When I was a consultant, I use to reach out to my customers to check in. Sometimes best practices change over time or you discover a feature that you enabled that can cause issues. This allowed me to make changes, provide recommendations and to help make things better. Vlan Groups was a thing in the past because folks has small subnets and the increase of wireless devices and IoT devices have outgrown the old design. These day's I would never use Vlan Groups or even secondary interfaces, because that tells you that you need to fix something and that is just a work around. Hopefully things work out with your upgrade.