topic Re: 9800WLC vlan based central switching issue in Wireless

9800WLC vlan based central switching issue

00uocpdgddPszkvs85d6 — Tue, 27 Feb 2024 10:59:03 GMT

We are facing an issue that vlan based central switching is not working on 9800 (Version: 17.9.3).

we have configured "flex vlan-central-switching" on the policy profile. Make sure the vlan ID is not in the flex profile vlan list. Radius has configured with the right vlan ID in the authorisation profile.

What we observed is WLC receives DHCP discovery from the client in capwap packets sent by flexconnect AP. However, WLC fails to pass on the DHCP discovery to upstream Layer 3 device for the centrally switched vlan, where ip helper address is configured. The client stays in IP Learn state.

{wncd_x_R0-0}{1}: [sisf-packet] [22116]: (info): RX: DHCPv4 from interface capwap_90000081 on vlan xxx Src MAC: xxxx.xxxx.xxxx Dst MAC: ffff.ffff.ffff src_ip: 0.0.0.0, dst_ip: 255.255.255.255, BOOTPREQUEST, SISF_DHCPDISCOVER, giaddr: 0.0.0.0, yiaddr: 0.0.0.0, CMAC: xxxx.xxxx.xxxx

In contrast, with centrally switching SSID configured with the same vlan. DHCP discovery packets are passed on by WLC to the upstream Layer 3 device on the right vlan and the subsequent DHCP offer, DHCP request and DHCP ACK flow as per normal and working fine.

So, the vlan configuration on WLC and upstream layer 3 device seems fine.

Could anyone shed any light on what could cause the WLC not passing on DHCP discovery packets; or point to us what we might have missed in terms of configuration required for vlan based central switching to work?

Thanks,

Re: 9800WLC vlan based central switching issue

Mark Elsen — Tue, 27 Feb 2024 11:35:30 GMT

>.... what we might have missed in terms of configuration required for vlan based central switching to work?
- Start with a checkup of the 9800 WLC configuration using the CLI command show tech wireless and feed that output into :
Wireless Config Analyzer

Re: 9800WLC vlan based central switching issue

00uocpdgddPszkvs85d6 — Wed, 28 Feb 2024 06:45:16 GMT

Thanks for the reply!
Have checked config with the analyzer tool, and nothing stands out as configuration errors specially related to the SSID and policy profile and flex profile.

Thanks

Re: 9800WLC vlan based central switching issue

Mark Elsen — Wed, 28 Feb 2024 08:37:01 GMT

- Note however that any errors red flagged by WirelessAnalyzer should be corrected first ; further fully debug the particular client(s) using : https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity
Client debugs (so called RadioActive Traces) ; can be high level analyzed with : Wireless Debug Analyzer

Re: 9800WLC vlan based central switching issue

Rich R — Wed, 28 Feb 2024 15:30:30 GMT

Why are you using "flex vlan-central-switching"? If you want the SSID centrally switched then why not make it centrally switched?

Have you checked the restrictions for use of the "VLAN-based Central Switching for FlexConnect" feature?
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-9/config-guide/b_wl_17_9_cg/m_vewlc_flex_connect.html#vlan-central-switching

Update to TAC recommended software version as per the link below to eliminate known, fixed bugs.

Re: 9800WLC vlan based central switching issue

00uocpdgddPszkvs85d6 — Fri, 01 Mar 2024 04:55:19 GMT

the restrictions are checked and they are not applied to us.

BTW, we have used the exact same feature on Aire8540 and working fine.

Re: 9800WLC vlan based central switching issue

Rich R — Fri, 01 Mar 2024 09:13:05 GMT

Never assume AireOS and IOS-XE will work the same way.
DHCP, in particular, is one of the features that has major changes. AireOS used DHCP proxy while IOS-XE uses standards based DHCP relay and follows the WLC routing table to DHCP server.

You did not answer my questions so I'll ask again:
Why are you using "flex vlan-central-switching"?
If you want the SSID centrally switched then why not make it centrally switched?

It's entirely possible that you've found a bug in that particular feature (which I've never heard of anyone using before - I had to read up what it does) which is why I asked the question about why you're using that feature. If you're making the config more complicated than it needs to be by using a feature you don't need then the answer may be to simplify the config and don't use that feature.

Also see:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwf13740
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwh43715

Re: 9800WLC vlan based central switching issue

Skjoedt — Fri, 27 Jun 2025 09:46:56 GMT

Did you find a fix for the issue?
- It seems that i am running into the same issue at a customer running ver. 17.15.3 because of the new CW9800M minimum software requirement.

My customer wants to flexconnect local switch EAP-TLS clients and Central switch PEAP clients to a guest VLAN.

Re: 9800WLC vlan based central switching issue

Skjoedt — Wed, 17 Sep 2025 06:40:53 GMT

Hello

I have now "completed" a Cisco TAC case on the issue and there is a "bug" on the issue, but unfortunately it is a "documentation bug", meaning that it is working as designed, this is the behavior in 9800.

Quote from the bug:
"Conditions: You need to have multiple conditions to hit this defect :
1 - Have one SSID linked to a policy profile with VLAN-based central switching enabled on a policy tag
2 - Add a second SSID to this policy tag, linked to a policy profile where a "central" VLAN is used (= a VLAN not present in the flex profile).

When this second SSID is added, the first SSID will not behave correctly and all clients will be locally switched, instead of being switched based on the VLAN.

Workaround:
- Remove the policy profile causing the issue from the policy tag (create a different policy tag , or
- Avoid using a central VLAN (= not defined on the flex profile) on the second policy profile."

Re: 9800WLC vlan based central switching issue

MyHomeNWLab — Wed, 17 Sep 2025 07:46:19 GMT

Thank you for the information!
I've found the relevant issue — it's CSCwm40007.

CSCwm40007: VLAN based central switching breaks when PP with central VLAN is pushed to policy tag
https://bst.cisco.com/bugsearch/bug/CSCwm40007