topic Re: Config between Cisco WC 5508 & 9800 in Wireless

Config between Cisco WC 5508 & 9800

Nenday — Mon, 29 Jan 2024 23:32:04 GMT

Hello Team,

I'm moving from my old Cisco WC controller model 5508 to new 9800, Actually I finish everything with AP's and ISE and Radius as well,

for the guest user we use Captive portal from ISE and special DHCP server (accessible only thraught the FW), so now I'm facing w small problem that from the main site I can get IP adress from the that DHCP server, but from distant site the guest user's didn't get IP adress,

I check in the old conroller I found the DHCP realy is checked and also virtual interface is added with adress 1.1.1.1 so when user's connect to guest network (from old WC always) they get an IP address,

Suffixe DNS propre à la connexion. . . : Guest-Network Description. . . . . . . . . . . . . . : Intel(R) Wi-Fi 6 AX201 160MHz Adresse physique . . . . . . . . . . . : 8C-XX-XX-XX-XX DHCP activé. . . . . . . . . . . . . . : Oui Configuration automatique activée. . . : Oui Adresse IPv6 de liaison locale. . . . .: fe80:: Adresse IPv4. . . . . . . . . . . . . .: 192.2.1.134(préféré) Masque de sous-réseau. . . . . . . . . : 255.255.224.0 Bail obtenu. . . . . . . . . . . . . . : 23 janvier 2024 13:04:38 Bail expirant. . . . . . . . . . . . . : 23 janvier 2024 21:04:37 Passerelle par défaut. . . . . . . . . : 192.2.0.1 Serveur DHCP . . . . . . . . . . . . . : 1.1.1.1 IAID DHCPv6 . . . . . . . . . . . : 176969034 DUID de client DHCPv6. . . . . . . . : 0 Serveurs DNS. . . . . . . . . . . . . : 192.1.3.11 NetBIOS sur Tcpip. . . . . . . . . . . : Activé

I don't know where I can align the configuration as the big difference between controllers,

Re: Config between Cisco WC 5508 & 9800

Haydn Andrews — Mon, 29 Jan 2024 23:49:36 GMT

is the SSID centrally switched or local switched (flexconnect).

Is there a different config for the wireless for the remote site vs the main site

Re: Config between Cisco WC 5508 & 9800

Mark Elsen — Tue, 30 Jan 2024 07:48:33 GMT

- FYI : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800CWA

Re: Config between Cisco WC 5508 & 9800

Nenday — Tue, 30 Jan 2024 13:52:15 GMT

its FlexConnect,

the same configuration for the remote and the main site,
in the old WC it's work correctly but in the new I don't know how to align the config to work as well on remote site (because it's work in the main site)

Re: Config between Cisco WC 5508 & 9800

Nenday — Tue, 30 Jan 2024 13:53:55 GMT

thank you for your response,
my issue is different, the users on the remote site can't get a DHCP IP when connect to guest network (of course with the new 9800)

Re: Config between Cisco WC 5508 & 9800

Mark Elsen — Tue, 30 Jan 2024 15:04:24 GMT

- Engage into full client debugging according to : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213949-wireless-debugging-and-log-collection-on.html#toc-hId-1012496422
You can have client debugs (so called RadioActive Traces) analyzee with : https://cway.cisco.com/wireless-debug-analyzer/

Re: Config between Cisco WC 5508 & 9800

Mark Elsen — Tue, 30 Jan 2024 15:17:55 GMT

Also have a checkup of the WLC configuration with the CLI command show tech wireless ; feed the output into :
Wireless Config Analyzer
This procedure is strongly adviced 'anyways!' and 'in all circumstances!'

Re: Config between Cisco WC 5508 & 9800

Rich R — Tue, 30 Jan 2024 22:34:15 GMT

> its FlexConnect,
You didn't answer the crucial question though: is the SSID centrally switched or local switched?

If it's centrally switched where is the DHCP relay being done - on the central switch/router or on the WLC? (which will then require an SVI to be configured on the WLC (not recommended by Cisco as per the Best Practice guidelines below).

Have a good read through the Best Practice guide for a start. Note that AireOS actually does a kind of hybrid proxy/relay of DHCP (not true DHCP relay) while 9800 does standards compliant DHCP relay (same as helper address on IOS router).

Re: Config between Cisco WC 5508 & 9800

Nenday — Wed, 31 Jan 2024 00:04:12 GMT

hello,

thank you for your response,

yes i Centrally Switched SSID, in old WLC yes we're using the DHCP proxy option,

I'll have good read on the best practice of the 9800 to check the best option and the best way to configure the DHCP for guest user

Re: Config between Cisco WC 5508 & 9800

Rich R — Wed, 31 Jan 2024 00:19:32 GMT

If it is centrally switched then the local and remote users should have exactly the same behaviour since they will all be tunnelled to the WLC over CAPWAP, so that doesn't really make sense, or are they using different WLANs with different config? We probably need to see how you've configured your 9800 to see what you've done wrong.

Re: Config between Cisco WC 5508 & 9800

Nenday — Sat, 03 Feb 2024 03:53:42 GMT

Hello Cisco Community,

I'm still in the trouble for the second weeks, I did some analyse and i found some strange thing, to simplify I did it with ping

From the DHCP server I can ping correctly the old controller, but impossible to ping the new one,

I capture the packet I found that the ping reach the New controller but don't found where to go, probably because the SVI don't have a gateway then the traffic go for another interface (wrong one) and the, no response for my ping,

and the same thing for dhcp server, as the client keep send discover but without any response,

how I can turn around and tell the traffic coming where to go, for example if traffic coming for guest SVI must go for it not for managment vlan,

thanks in advance

Re: Config between Cisco WC 5508 & 9800

Mark Elsen — Sat, 03 Feb 2024 08:10:16 GMT

- Have a checkup of the 9800 WLC configuration with the CLI command show tech wireless ; feed the output into :
Wireless Config Analyzer

Re: Config between Cisco WC 5508 & 9800

Rich R — Sat, 03 Feb 2024 13:39:27 GMT

AireOS and IOS-XE are completely different in their handling of client DHCP.
AireOS proxies the DHCP and all communication to client uses the virtual IP while all communication to the server is done on the client VLAN with the interface address as source.
IOS-XE does standards based DHCP relay. It relays the client request to the server (following the routing table) and routes the reply back to the client, does not proxy the request like AireOS.
This is why SVI is not recommended on 9800 because there is no isolation between client interfaces and global routing table of 9800.
This means that just like on any other IOS router or switch you must specify the source interface to use for relay and make sure the 9800 has a route to reach the DHCP server. By default it will simply follow the default route. Similarly the DHCP server must have a return route to the WLC relay source address and the client address.

Either switch to using layer 2 with DHCP relay done on the external network or re-design for the 9800 architecture. This is one of the major differences between AireOS and IOS-XE.

https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html#DHCPproxy
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_dhcp_wlan_9800.html

Re: Config between Cisco WC 5508 & 9800

Nenday — Sat, 03 Feb 2024 13:20:14 GMT

thank you for your response,

the only thing I get about DHCP server is just this, and It's done in this side too

Re: Config between Cisco WC 5508 & 9800

Mark Elsen — Sat, 03 Feb 2024 13:32:27 GMT

- Ok ,take advices from : https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html#DHCPbridgingandDHCPrelay
and or make corrections ,if needed,

Re: Config between Cisco WC 5508 & 9800

Rich R — Sat, 03 Feb 2024 13:33:49 GMT

Did you read my reply below?

Re: Config between Cisco WC 5508 & 9800

Nenday — Sun, 04 Feb 2024 02:38:41 GMT

Hello Rich,

Sorry I read your response and Sorry I think I response but probably I forget to submit,

Frankly there is a huge difference between AirOs and IOS-XE, and I follow your suggestion and I configure the Interface (used for guest) and I follow the recommandation, but still in the same troubele,
here is the command for show run interface :

98001wlc1-9800#show run interface Vla990 Building configuration... Current configuration : 219 bytes ! interface Vlan990 description Internet ip dhcp relay information trusted ip dhcp relay source-interface Vlan990 ip address 192.17.0.4 255.255.224.0 ip helper-address 192.17.0.1 no mop enabled no mop sysid end

as I said in the first post, from main network it's work properly but the problem happen when guest user try to connect from distant site (VPN or MPLS Site )

so I try with ping and found that the DHCP server can't ping the Controller, like the DHCP server don't know the route where send it, and same when send packet (DHCP discover from controller to server, but no response from server like the DHCP offer don't know where to go and how to reach the controller)

as you said we're talking about route back

here is an example of my design to understand the situation clearly :
the WLC is in the same lavel with DHCP server, both run in Vmware they are connected to Core Switch and the Firewall is gateway for the network 990 (VLAN990 is the vlan for guest)

I'm trying to make some changement and many update but alway same result, guest user in main site ok, distant site (can't obtain IP)

Re: Config between Cisco WC 5508 & 9800

Nenday — Sun, 04 Feb 2024 03:38:12 GMT

Hello Rich,
I respond to you 2 times today but the reponse deleted (like it's SPAM)
It's very clear there is a big difference between AIreOS and IOS-XE, and I configure everything according to cisco recommandation,
so in the main site users can connect correctly, the domain user have the SSID, the guest users too they get IP and go for captive portal and then connect to wireless, in the distant site the domain users connect the wireless as well as, but guest users can't

I followed the recommandation and I configure SVI as recommanded below the command show run interface : for your information the ip 192.17.0.1 is the IP address of FW interface of this network and inside the interface we define also the DHCP Relay

9800wlc1-9800#show run interface Vlan990 Building configuration... Current configuration : 219 bytes ! interface Vlan990 description Internet ip dhcp relay information trusted ip dhcp relay source-interface Vlan990 ip address 192.17.0.4 255.255.224.0 ip helper-address 192.17.0.1 no mop enabled no mop sysid end

I'm going to send you the design example in private because I can't post it here,

Re: Config between Cisco WC 5508 & 9800

Rich R — Sun, 04 Feb 2024 23:42:47 GMT

Hi @Nenday

So let's clarify a few things:
- Is the WLAN centrally switched?
- Are you using the same WLAN and client interface for the local and remote sites?
- What does the config for the WLAN and policy profile look like?
- Is VLAN 990 the client interface? If so you don't need DHCP relay at all because the DHCP server is in the same subnet as the client and WLC (WLC interface 192.17.0.4 255.255.224.0 and DHCP server 192.17.0.1). In fact you don't even need the SVI, you should be using layer 2 with no SVI. You only need to use DHCP relay when your DHCP server is not on the local subnet (same broadcast domain as client).
- Since you're obviously using 9800-CL on VMWARE. Have you configured ESX as per the installation guide and best practices guide - forged transmits and promiscuous mode enabled? It will not work correctly without that.

Re: Config between Cisco WC 5508 & 9800

Rich R — Sun, 04 Feb 2024 11:37:57 GMT

You posts are coming through ok - it's more likely a problem with your browser and Cisco cookies which are very badly managed by Cisco. Clear your browser cache and cookies then restart the browser before accessing the site again.