topic Do you have rogue DHCP in Wireless

DHCP Snooping WLC

julien Hernandez — Mon, 05 Jul 2021 09:04:48 GMT

Hi,

I would like to DHCP snooping on the WLC.

Or a method to block DHCP pirate and authorized my DHCP.

Best Regards,

Julien Hernandez.

Do you have rogue DHCP

Rasika Nayanajith — Fri, 05 Dec 2014 10:19:22 GMT

Do you have rogue DHCP servers on wireless ? If you have configure the ip-helper address on dynamic-interfaces pointing to your proper DHCP server then all wireless users DHCP packet should go to that.

Typically you would have rogue DHCP on a wired network & you can implement DHCP snooping to block them. Here is how you configure it in a wired network

http://mrncciew.com/2012/12/27/understanding-dhcp-snooping/

HTH

Rasika

**** Pls rate all useful responses ****

ip-helper was configured on

julien Hernandez — Fri, 05 Dec 2014 10:43:04 GMT

ip-helper was configured on the VLAN interface on my switch.

I must configuer ip-helper also on the WLC ?

As shown in the image attached i have clients on the network 192.168.0.0 it's not my internal network.

So i would block the DHCP pirate and authorize my dhcp DHCP

on the switch WiFi no need to set up dhcp snooping because that only WiFi.

I just set up the ip-helper

julien Hernandez — Fri, 05 Dec 2014 12:48:49 GMT

I just set up the ip-helper address on dynamic-interfaces on the WLC.

I notice there are client with IP address 0.0.0.0

I make a debug client :

(Cisco Controller) >*apfMsConnTask_3: Dec 05 10:55:17.610: dot1xcb = (nil) eapolReplayCounter = 0x42484e6a So returning from getEapolReplayCounter
*apfMsConnTask_0: Dec 05 10:55:20.988: dot1xcb = (nil) eapolReplayCounter = 0x41b6ce6a So returning from getEapolReplayCounter
*apfMsConnTask_3: Dec 05 10:55:29.228: dot1xcb = (nil) eapolReplayCounter = 0x42484e6a So returning from getEapolReplayCounter
*apfMsConnTask_1: Dec 05 10:55:35.557: dot1xcb = (nil) eapolReplayCounter = 0x41e74e6a So returning from getEapolReplayCounter
*apfMsConnTask_3: Dec 05 10:55:45.079: dot1xcb = (nil) eapolReplayCounter = 0x42484e6a So returning from getEapolReplayCounter
*apfMsConnTask_1: Dec 05 10:55:52.315: dot1xcb = (nil) eapolReplayCounter = 0x41e74e6a So returning from getEapolReplayCounter
*apfMsConnTask_4: Dec 05 10:56:11.695: dot1xcb = (nil) eapolReplayCounter = 0x4278ce6a So returning from getEapolReplayCounter
*apfMsConnTask_6: Dec 05 10:56:14.316: dot1xcb = (nil) eapolReplayCounter = 0x42d9ce6a So returning from getEapolReplayCounter
*apfMsConnTask_0: Dec 05 10:56:16.194: dot1xcb = (nil) eapolReplayCounter = 0x41b6ce6a So returning from getEapolReplayCounter
*apfMsConnTask_2: Dec 05 10:56:16.966: dot1xcb = (nil) eapolReplayCounter = 0x4217ce6a So returning from getEapolReplayCounter
*apfMsConnTask_0: Dec 05 10:56:17.461: dot1xcb = (nil) eapolReplayCounter = 0x41b6ce6a So returning from getEapolReplayCounter
*apfMsConnTask_0: Dec 05 10:56:46.083: dot1xcb = (nil) eapolReplayCounter = 0x41b6ce6a So returning from getEapolReplayCounter
*apfMsConnTask_6: Dec 05 10:56:50.746: dot1xcb = (nil) eapolReplayCounter = 0x42d9ce6a So returning from getEapolReplayCounter
*apfMsConnTask_0: Dec 05 10:57:27.302: dot1xcb = (nil) eapolReplayCounter = 0x41b6ce6a So returning from getEapolReplayCounter
*apfMsConnTask_1: Dec 05 10:57:37.841: dot1xcb = (nil) eapolReplayCounter = 0x41e74e6a So returning from getEapolReplayCounter
*apfMsConnTask_6: Dec 05 10:57:40.718: dot1xcb = (nil) eapolReplayCounter = 0x42d9ce6a So returning from getEapolReplayCounter
*apfMsConnTask_7: Dec 05 10:57:45.066: dot1xcb = (nil) eapolReplayCounter = 0x430a4e6a So returning from getEapolReplayCounter
*apfMsConnTask_3: Dec 05 10:57:58.369: dot1xcb = (nil) eapolReplayCounter = 0x42484e6a So returning from getEapolReplayCounter
*apfMsConnTask_7: Dec 05 10:58:28.558: dot1xcb = (nil) eapolReplayCounter = 0x430a4e6a So returning from getEapolReplayCounter
*apfMsConnTask_7: Dec 05 10:58:44.515: dot1xcb = (nil) eapolReplayCounter = 0x430a4e6a So returning from getEapolReplayCount

debug client :

(Cisco Controller) >*dot1xMsgTask: Dec 05 13:45:10.344: GTK Rotation Kicked in for AP: 44:ad:d9:5f:3a:20 SlotId = 1 - (0x3adb3bf8)
*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 Reassociation received from mobile on BSSID 44:ad:d9:5f:3a:d0
*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 Global 200 Clients are allowed to AP radio

*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 Max Client Trap Threshold: 0 cur: 1

*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 Rf profile 600 Clients are allowed to AP wlan

*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 override for default ap group, marking intgrp NULL
*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 Applying Interface policy on Mobile, role Local. Ms NAC State 2 Quarantine Vlan 0 Access Vlan 321

*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 Re-applying interface policy for client

*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 0.0.0.0 RUN (20) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2219)
*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 0.0.0.0 RUN (20) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2240)
*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 apfApplyWlanPolicy: Apply WLAN Policy over PMIPv6 Client Mobility Type
*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 In processSsidIE:4850 setting Central switched to FALSE
*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 Applying site-specific Local Bridging override for station 78:9e:d0:22:5e:33 - vapId 1, site 'INDE', interface 'interface_resident'
*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 Applying Local Bridging Interface Policy for station 78:9e:d0:22:5e:33 - vlan 321, interface id 12, interface 'interface_resident'
*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 override from ap group, removing intf group from mscb
*apfMsConnTask_5: Dec 05 13:45:14.401: 78:9e:d0:22:5e:33 Applying site-specific override for station 78:9e:d0:22:5e:33 - vapId 1, site 'INDE', interface 'interface_resident'
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 Applying Interface policy on Mobile, role Local. Ms NAC State 2 Quarantine Vlan 0 Access Vlan 321

*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 Re-applying interface policy for client

*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 0.0.0.0 RUN (20) Changing IPv4 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2219)
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 0.0.0.0 RUN (20) Changing IPv6 ACL 'none' (ACL ID 255) ===> 'none' (ACL ID 255) --- (caller apf_policy.c:2240)
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 processSsidIE statusCode is 0 and status is 0
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 processSsidIE ssid_done_flag is 0 finish_flag is 0
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 STA - rates (8): 2 4 11 12 18 150 24 36 48 72 96 108 0 0 0 0
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 suppRates statusCode is 0 and gotSuppRatesElement is 1
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 STA - rates (12): 2 4 11 12 18 150 24 36 48 72 96 108 0 0 0 0
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 extSuppRates statusCode is 0 and gotExtSuppRatesElement is 1
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 pemApfDeleteMobileStation2: APF_MS_PEM_WAIT_L2_AUTH_COMPLETE = 0.
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 0.0.0.0 RUN (20) Deleted mobile LWAPP rule on AP [44:ad:d9:5f:39:00]
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 Updated location for station old AP 44:ad:d9:5f:39:00-0, new AP 44:ad:d9:5f:3a:d0-0
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 Updating AID for REAP AP Client 44:ad:d9:5f:3a:d0 - AID ===> 1
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 0.0.0.0 RUN (20) Applied RADIUS override policy
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 Central switch is FALSE
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 Sending the Central Auth Info
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 Central Auth Info Allocated PMKLen = 0

*apfMsConnTask_5: Dec 05 13:45:14.402: dot1xcb = (nil) eapolReplayCounter = 0x42a94e6a So returning from getEapolReplayCounter
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 EapolReplayCounter: 00 00 00 00 00 00 00 00
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 msAssocTypeFlagsMsb = 0 msAssocTypeFlagsLsb = 0
apfMsEntryType = 0 apfMsEapType = 0
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 Sending Local Switch flag = 0
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 0.0.0.0 RUN (20) DHCP Not required on AP 44:ad:d9:5f:3a:d0 vapId 1 apVapId 1for this client
*apfMsConnTask_5: Dec 05 13:45:14.402: 78:9e:d0:22:5e:33 Not Using WMM Compliance code qosCap 00
*apfMsConnTask_5: Dec 05 13:45:14.403: 78:9e:d0:22:5e:33 0.0.0.0 RUN (20) Plumbed mobile LWAPP rule on AP 44:ad:d9:5f:3a:d0 vapId 1 apVapId 1 flex-acl-name:
*apfMsConnTask_5: Dec 05 13:45:14.403: 78:9e:d0:22:5e:33 0.0.0.0 RUN (20) Change state to RUN (20) last state RUN (20)

*apfMsConnTask_5: Dec 05 13:45:14.403: 78:9e:d0:22:5e:33 apfPemAddUser2 (apf_policy.c:333) Changing state for mobile 78:9e:d0:22:5e:33 on AP 44:ad:d9:5f:3a:d0 from Associated to Associated

*apfMsConnTask_5: Dec 05 13:45:14.403: 78:9e:d0:22:5e:33 apfPemAddUser2:session timeout forstation 78:9e:d0:22:5e:33 - Session Tout 15000, apfMsTimeOut '15000' and sessionTimerRunning flag is 0
*apfMsConnTask_5: Dec 05 13:45:14.403: 78:9e:d0:22:5e:33 Scheduling deletion of Mobile Station: (callerId: 49) in 15000 seconds
*apfMsConnTask_5: Dec 05 13:45:14.403: 78:9e:d0:22:5e:33 Func: apfPemAddUser2, Ms Timeout = 15000, Session Timeout = 15000

*apfMsConnTask_5: Dec 05 13:45:14.403: 78:9e:d0:22:5e:33 Sending Assoc Response to station on BSSID 44:ad:d9:5f:3a:d0 (status 0) ApVapId 1 Slot 0
*apfMsConnTask_5: Dec 05 13:45:14.403: 78:9e:d0:22:5e:33 apfProcessAssocReq (apf_80211.c:8294) Changing state for mobile 78:9e:d0:22:5e:33 on AP 44:ad:d9:5f:3a:d0 from Associated to Associated

*spamApTask0: Dec 05 13:45:14.405: 78:9e:d0:22:5e:33 spamEncodeCentralAuthInoMsPayload: msAssocTypeFlagsMsb = 0 msAssocTypeFlagsLsb = 0
apfMsEntryType = 0 pmkLen = 0
*apfMsConnTask_1: Dec 05 13:45:34.177: dot1xcb = (nil) eapolReplayCounter = 0x41e74e6a So returning from getEapolReplayCounter
*apfMsConnTask_1: Dec 05 13:45:51.853: dot1xcb = (nil) eapolReplayCounter = 0x41e74e6a So returning from getEapolReplayCounter
*apfMsConnTask_0: Dec 05 13:46:02.400: dot1xcb = (nil) eapolReplayCounter = 0x41b6ce6a So returning from getEapolReplayCounter
*dot1xMsgTask: Dec 05 13:46:16.160: GTK Rotation Kicked in for AP: 50:67:ae:30:e0:e0 SlotId = 0 - (0x3adb3bf8)
*apfMsConnTask_1: Dec 05 13:46:29.123: dot1xcb = (nil) eapolReplayCounter = 0x41e74e6a So returning from getEapolReplayCounter

pls attach these outputs to

Rasika Nayanajith — Fri, 05 Dec 2014 17:16:53 GMT

pls attach these outputs to get an better idea how you configure it

WLC - show interface summary
WLC - show interface detailed vlan x <- vlan that map to SSID
WLC - show wlan <wlan_id> 
SW - show run interface vlan x
SW-  show run int gx/x <- WLC connected swtichport

HTH

Rasika

**** Pls rate all useful responses ****

(Cisco Controller) >show

julien Hernandez — Mon, 08 Dec 2014 09:01:38 GMT

(Cisco Controller) >show interface summary

Number of Interfaces.......................... 4

Interface Name                   Port Vlan Id IP Address      Type    Ap Mgr Guest
-------------------------------- ---- -------- --------------- ------- ------ -----
interface_administratif          1    221      10.20.167.253   Dynamic No     No
interface_resident               1    321      10.30.167.253   Dynamic No     No
management                       1    20       10.253.21.4     Static Yes    No
virtual                          N/A N/A      1.1.1.1         Static No     No

(Cisco Controller) >

(Cisco Controller) >show wlan 1

WLAN Identifier.................................. 1
Profile Name..................................... Wifi City
Network Name (SSID).............................. WifiCity
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Client Profiling Status
    Radius Profiling ............................ Disabled
     DHCP ....................................... Disabled
     HTTP ....................................... Disabled
    Local Profiling ............................. Disabled
     DHCP ....................................... Disabled
     HTTP ....................................... Disabled
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Maximum number of Clients per AP Radio........... 200

--More-- or (q)uit
Number of Active Clients......................... 67
Exclusionlist.................................... Disabled
Session Timeout.................................. 15000 seconds
User Idle Timeout................................ Disabled
Sleep Client..................................... disable
Sleep Client Timeout............................. 12 hours
User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... Inde_WLC-2504_SS_04
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ interface_resident
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
WLAN Layer2 ACL.................................. unconfigured
mDNS Status...................................... Disabled
mDNS Profile Name................................ unconfigured
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
Quality of Service............................... Silver
Per-SSID Rate Limits............................. Upstream Downstream
Average Data Rate................................ 0 0

--More-- or (q)uit
Average Realtime Data Rate.......................   0             0
Burst Data Rate..................................   0             0
Burst Realtime Data Rate.........................   0             0
Per-Client Rate Limits........................... Upstream      Downstream
Average Data Rate................................   0             0
Average Realtime Data Rate.......................   0             0
Burst Data Rate..................................   0             0
Burst Realtime Data Rate.........................   0             0
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1

--More-- or (q)uit
Radius Servers
   Authentication................................ Disabled
   Accounting.................................... Disabled
   Dynamic Interface............................. Disabled
   Dynamic Interface Priority.................... wlan
Local EAP Authentication......................... Disabled
Security

   802.11 Authentication:........................ Open System
   FT Support.................................... Disabled
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Disabled
   WAPI.......................................... Disabled
   Wi-Fi Direct policy configured................ Disabled
   EAP-Passthrough............................... Disabled
   CKIP ......................................... Disabled
   Web Based Authentication...................... Disabled
   Web-Passthrough............................... Disabled
   Conditional Web Redirect...................... Disabled
   Splash-Page Web Redirect...................... Disabled
   Auto Anchor................................... Disabled
   FlexConnect Local Switching................... Enabled
   flexconnect Central Dhcp Flag................. Disabled
   flexconnect nat-pat Flag...................... Disabled
   flexconnect Dns Override Flag................. Disabled
   flexconnect PPPoE pass-through................ Disabled
   flexconnect local-switching IP-source-guar.... Disabled
   FlexConnect Vlan based Central Switching ..... Disabled
   FlexConnect Local Authentication.............. Disabled
   FlexConnect Learn IP Address.................. Disabled
   Client MFP.................................... Optional but inactive (WPA2 not configured)
   PMF........................................... Disabled
   PMF Association Comeback Time................. 1
   PMF SA Query RetryTimeout..................... 200
   Tkip MIC Countermeasure Hold-down Timer....... 60
   Eap-params.................................... Not Applicable
AVC Visibilty.................................... Disabled
AVC Profile Name................................. None
Flow Monitor Name................................ None
Split Tunnel (Printers).......................... Disabled
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Disabled
802.11k Neighbor List Dual Band.................. Disabled
Band Select...................................... Enabled
Load Balancing................................... Client-Count Based
Multicast Buffer................................. Disabled

Mobility Anchor List
WLAN ID IP Address Status
------- --------------- ------

802.11u........................................ Disabled

MSAP Services.................................. Disabled

Local Policy
----------------
Priority Policy Name
-------- ---------------

(Cisco Controller) >show interface detailed interface_resident

Interface Name................................... interface_resident
MAC Address...................................... cc:d8:c1:40:cf:44
IP Address....................................... 10.30.167.253
IP Netmask....................................... 255.255.248.0
IP Gateway....................................... 10.30.167.254
External NAT IP State............................ Disabled
External NAT IP Address.......................... 0.0.0.0
VLAN............................................. 321
Quarantine-vlan.................................. 0
NAS-Identifier................................... Inde_WLC-2504_SS_04
Active Physical Port............................. 1
Primary Physical Port............................ 1
Backup Physical Port............................. Unconfigured
DHCP Proxy Mode.................................. Global
Primary DHCP Server.............................. 10.2.0.1
Secondary DHCP Server............................ 10.2.0.2
DHCP Option 82................................... Disabled
IPv4 ACL......................................... Unconfigured
mDNS Profile Name................................ Unconfigured
AP Manager....................................... No
Guest Interface.................................. No
L2 Multicast..................................... Enabled

interface Vlan321
description Resident_Inde
ip address 10.30.167.254 255.255.248.0
ip access-group resident in
ip helper-address 10.2.0.1
ip helper-address 10.2.0.2
end

interface FastEthernet1/0/23
description Controller_2504
switchport trunk encapsulation dot1q
switchport mode trunk
spanning-tree portfast trunk
end

ip access-list extended resident
permit udp any host 255.255.255.255 eq bootps
permit udp 10.30.0.0 0.1.255.255 host 10.2.0.1 eq bootps
permit udp 10.30.0.0 0.1.255.255 host 10.2.0.2 eq bootps
permit udp 10.30.0.0 0.1.255.255 host 10.2.0.1 eq domain
permit udp 10.30.0.0 0.1.255.255 host 10.2.0.2 eq domain
permit tcp 10.30.0.0 0.1.255.255 any eq 9100
deny ip any 10.0.0.0 0.255.255.255
deny ip any 192.168.0.0 0.0.255.255

deny   ip any 172.16.0.0 0.0.255.255
deny   ip any 224.0.0.0 31.255.255.255
deny   udp any eq netbios-ns any eq netbios-ns
deny   udp any eq netbios-dgm any eq netbios-dgm
deny   udp any any eq netbios-ss
remark Infection virale 31/07/2012
deny   udp any any eq 16464
deny   udp any any eq 16470
deny   udp any any eq 16471
deny   udp any any eq 16475
deny   udp any any eq 1900
deny   tcp any any eq 445
deny   tcp any any eq 139
permit ip 10.30.0.0 0.1.255.255 any

DHCP Address Assignment

Rasika Nayanajith — Mon, 08 Dec 2014 09:22:20 GMT

DHCP Address Assignment Required................. Disabled

Do you really required static client to join ? So current clients shown as 192.168.x.x may be static clients.

If you enable DHCP address assignment, all client has to get IP from your DHCP server, in that way you can control what IP a client can get.

Try that option & see what's client IP looks like.

HTH

Rasika

**** Pls rate all useful responses ****

not enable this option : The

julien Hernandez — Mon, 08 Dec 2014 09:35:47 GMT

not enable this option :

The following errors occurred while updating the WLAN:
Invalid Configuration: DHCP required or Web Auth cannot be enabled if Learn Client IP Address is disabled

To enable the following option for it to work:

Learn Client IP Address

I think he must have a pirate DHCP server and the DHCP pirate is quicker to respond than my own DHCP server.

Invalid Configuration: DHCP

Rasika Nayanajith — Mon, 08 Dec 2014 09:38:38 GMT

Invalid Configuration: DHCP required or Web Auth cannot be enabled if Learn Client IP Address is disabled

This is because of the following setting

FlexConnect Learn IP Address.................. Disabled

You can enable this & then tick the "DHCP address assignment" option.

Note that wlan setting changes could disrupt client connectivity momentarily.

**** Pls do not forget to rate our responses if that is useful to you ****

HTH

Rasika

what is this option ?

julien Hernandez — Mon, 08 Dec 2014 09:47:09 GMT

what is this option ?

FlexConnect Learn IP Address.................. Disabled

Always 192.168.0.0 and 0.0.0.0 on WLC

it should block the pirate DHCP and authorize my DHCP server

This should be under WLAN

Rasika Nayanajith — Mon, 08 Dec 2014 09:50:50 GMT

This should be under WLAN "Advanced" tab. Since it is disabled, you cannot tick the "DHCP Address Assignment" Option. That's what previously provided error message states.

Do you have "FlexConnect" mode AP deployed in your setup to use this WLAN ?

HTH

Rasika

option FlexConnect Learn IP

julien Hernandez — Mon, 08 Dec 2014 09:55:07 GMT

option FlexConnect Learn IP Address and DHCP Address Assignment Required is enable but still 192.168.0.0 and 0.0.0.0

it should block the pirate DHCP and authorize my DHCP server

Click that client & remove

Rasika Nayanajith — Mon, 08 Dec 2014 10:24:56 GMT

Click that client & remove (Monitor -> Client - > Select client -> Remove) & see if that connects again.

If it showing again, trace the mac-address of the client & see from where you learn that MAC address.

HTH

Rasika

I'm coming remove client 192

julien Hernandez — Mon, 08 Dec 2014 10:26:22 GMT

I'm coming remove client 192.168.0.0 and over client 192.168.0.0

if a rogue AP how to do to prohibit ?

or make an ACL to prevent pirate DHCP

I'm coming remove client 192

Rasika Nayanajith — Mon, 08 Dec 2014 10:30:06 GMT

I'm coming remove client 192.168.0.0 and over client 192.168.0.0

Did not understand what you say here. Did you able to remove the client ? Did it reappear ?

if a rogue AP how to do to prohibit ?

If it is Rogue AP, it should come from wired side & should not appear as a wireless client

Let me know

Rasika

I remove clients 192.168.0.0

julien Hernandez — Mon, 08 Dec 2014 16:02:19 GMT

once the mac adress remove with IP 192.168.0.0 on the WLC other MAC adress IP 192.168.0.0 always present on the WLC.

But always different MAC adress with IP 192.168.0.0 on WLC.

Do you have an idea to allow my DHCP server and block the DHCP pirate.

What would be the output

Rasika Nayanajith — Mon, 08 Dec 2014 19:32:35 GMT

What would be the output looks like for "show client detail <client_mac_addr>" for a suspicious client.

Rasika

Here the client 192.168.0.0 :

julien Hernandez — Tue, 09 Dec 2014 08:57:04 GMT

Here the client 192.168.0.0 :

(Cisco Controller) >show client detail 1c:99:4c:6f:c6:96
Client MAC Address............................... 1c:99:4c:6f:c6:96
Client Username ................................. N/A
AP MAC Address................................... 44:ad:d9:57:fd:20
AP Name.......................................... AP-INDE-106
AP radio slot Id................................. 0
Client State..................................... Associated
Client NAC OOB State............................. Access
Wireless LAN Id.................................. 1
Hotspot (802.11u)................................ Not Supported
BSSID............................................ 44:ad:d9:57:fd:20
Connected For ................................... 8127 secs
Channel.......................................... 11
IP Address....................................... 192.168.0.155
Gateway Address.................................. Unknown
Netmask.......................................... Unknown
Association Id................................... 8
Authentication Algorithm......................... Open System
Reason Code...................................... 1
Status Code...................................... 0
Session Timeout.................................. 15000
Client CCX version............................... No CCX support
QoS Level........................................ Silver
Avg data Rate.................................... 0
Burst data Rate.................................. 0
Avg Real time data Rate.......................... 0
Burst Real Time data Rate........................ 0
802.1P Priority Tag.............................. disabled
CTS Security Group Tag........................... Not Applicable
KTS CAC Capability............................... No
WMM Support...................................... Enabled
APSD ACs....................................... BK BE VI VO
Power Save....................................... ON
Current Rate..................................... m7
Supported Rates.................................. 5.5,11.0,6.0,9.0,12.0,18.0,
............................................. 24.0,36.0,48.0,54.0
Mobility State................................... Local
Mobility Move Count.............................. 0
Security Policy Completed........................ Yes
Policy Manager State............................. RUN
Policy Manager Rule Created...................... Yes
Audit Session ID................................. none
AAA Role Type.................................... none
Local Policy Applied............................. none
IPv4 ACL Name.................................... none
FlexConnect ACL Applied Status................... Unavailable
IPv4 ACL Applied Status.......................... Unavailable
IPv6 ACL Name.................................... none
IPv6 ACL Applied Status.......................... Unavailable
Layer2 ACL Name.................................. none
Layer2 ACL Applied Status........................ Unavailable
mDNS Status...................................... Disabled
mDNS Profile Name................................ none
No. of mDNS Services Advertised.................. 0
Policy Type...................................... N/A
Encryption Cipher................................ None
Protected Management Frame ...................... No
Management Frame Protection...................... No
EAP Type......................................... Unknown
FlexConnect Data Switching....................... Local
FlexConnect Dhcp Status.......................... Local
FlexConnect Vlan Based Central Switching......... No
FlexConnect Authentication....................... Central
Quarantine VLAN.................................. 0
Access VLAN...................................... 321
Client Capabilities:
CF Pollable................................ Not implemented
CF Poll Request............................ Not implemented
Short Preamble............................. Implemented
PBCC....................................... Not implemented
Channel Agility............................ Not implemented
Listen Interval............................ 10
Fast BSS Transition........................ Not implemented
Client Wifi Direct Capabilities:
WFD capable................................ No
Manged WFD capable......................... No
Cross Connection Capable................... No
Support Concurrent Operation............... No
Fast BSS Transition Details:
Client Statistics:
Number of Bytes Received................... 2526655
Number of Bytes Sent....................... 2425132
Total Number of Bytes Sent................. 2425132
Total Number of Bytes Recv................. 2526655
Number of Bytes Sent (last 90s)............ 64
Number of Bytes Recv (last 90s)............ 6764
Number of Packets Received................. 25105
Number of Packets Sent..................... 5996
Number of Interim-Update Sent.............. 0
Number of EAP Id Request Msg Timeouts...... 0
Number of EAP Id Request Msg Failures...... 0
Number of EAP Request Msg Timeouts......... 0
Number of EAP Request Msg Failures......... 0
Number of EAP Key Msg Timeouts............. 0
Number of EAP Key Msg Failures............. 0
Number of Data Retries..................... 1018
Number of RTS Retries...................... 0
Number of Duplicate Received Packets....... 56
Number of Decrypt Failed Packets........... 0
Number of Mic Failured Packets............. 0
Number of Mic Missing Packets.............. 0
Number of RA Packets Dropped............... 0
Number of Policy Errors.................... 0
Radio Signal Strength Indicator............ -60 dBm
Signal to Noise Ratio...................... 24 dB
Client Rate Limiting Statistics:
Number of Data Packets Recieved............ 0
Number of Data Rx Packets Dropped.......... 0
Number of Data Bytes Recieved.............. 0
Number of Data Rx Bytes Dropped............ 0
Number of Realtime Packets Recieved........ 0
Number of Realtime Rx Packets Dropped...... 0
Number of Realtime Bytes Recieved.......... 0
Number of Realtime Rx Bytes Dropped........ 0
Number of Data Packets Sent................ 0
Number of Data Tx Packets Dropped.......... 0
Number of Data Bytes Sent.................. 0
Number of Data Tx Bytes Dropped............ 0
Number of Realtime Packets Sent............ 0
Number of Realtime Tx Packets Dropped...... 0
Number of Realtime Bytes Sent.............. 0
Number of Realtime Tx Bytes Dropped........ 0
Nearby AP Statistics:
AP-INDE-108(slot 0)
antenna0: 5364 secs ago.................. -74 dBm
antenna1: 5364 secs ago.................. -87 dBm
AP-INDE-106(slot 0)
antenna0: 5364 secs ago.................. -67 dBm
antenna1: 5364 secs ago.................. -57 dBm
AP-INDE-106(slot 1)
antenna0: 5363 secs ago.................. -82 dBm
antenna1: 5363 secs ago.................. -87 dBm
AP-INDE-111(slot 0)
antenna0: 5364 secs ago.................. -94 dBm
antenna1: 5364 secs ago.................. -97 dBm
AP-INDE-119(slot 0)
antenna0: 5364 secs ago.................. -87 dBm
antenna1: 5364 secs ago.................. -91 dBm
AP-INDE-105(slot 0)
antenna0: 5364 secs ago.................. -68 dBm
antenna1: 5364 secs ago.................. -79 dBm
AP-INDE-105(slot 1)
antenna0: 5363 secs ago.................. -90 dBm
antenna1: 5363 secs ago.................. -87 dBm
AP-INDE-109(slot 0)
antenna0: 5364 secs ago.................. -75 dBm
antenna1: 5364 secs ago.................. -85 dBm
AP-INDE-109(slot 1)
antenna0: 5364 secs ago.................. -83 dBm
antenna1: 5364 secs ago.................. -78 dBm
AP-INDE-121(slot 0)
antenna0: 14490 secs ago................. -91 dBm
antenna1: 14490 secs ago................. -92 dBm
AP-INDE-126(slot 0)
antenna0: 8132 secs ago.................. -89 dBm
antenna1: 8132 secs ago.................. -92 dBm
AP-INDE-126(slot 1)
antenna0: 38197 secs ago................. -93 dBm
antenna1: 38197 secs ago................. -83 dBm
AP-INDE-116(slot 0)
antenna0: 5364 secs ago.................. -61 dBm
antenna1: 5364 secs ago.................. -50 dBm
AP-INDE-116(slot 1)
antenna0: 5364 secs ago.................. -82 dBm
antenna1: 5364 secs ago.................. -86 dBm
AP-INDE-112(slot 0)
antenna0: 5364 secs ago.................. -71 dBm
antenna1: 5364 secs ago.................. -71 dBm
AP-INDE-112(slot 1)
antenna0: 5364 secs ago.................. -88 dBm
antenna1: 5364 secs ago.................. -90 dBm
AP-INDE-107(slot 0)
antenna0: 8129 secs ago.................. -91 dBm
antenna1: 8129 secs ago.................. -85 dBm
AP-INDE-118(slot 0)
antenna0: 5364 secs ago.................. -94 dBm
antenna1: 5364 secs ago.................. -91 dBm
AP-INDE-114(slot 0)
antenna0: 5364 secs ago.................. -93 dBm
antenna1: 5364 secs ago.................. -85 dBm
AP-INDE-114(slot 1)
antenna0: 38197 secs ago................. -93 dBm
antenna1: 38197 secs ago................. -91 dBm
AP-INDE-123(slot 0)
antenna0: 5364 secs ago.................. -72 dBm
antenna1: 5364 secs ago.................. -83 dBm
AP-INDE-103(slot 0)
antenna0: 5364 secs ago.................. -91 dBm
antenna1: 5364 secs ago.................. -83 dBm
AP-INDE-104(slot 0)
antenna0: 5364 secs ago.................. -87 dBm
antenna1: 5364 secs ago.................. -90 dBm
AP-INDE-102(slot 0)
antenna0: 5364 secs ago.................. -90 dBm
antenna1: 5364 secs ago.................. -87 dBm
DNS Server details:
DNS server IP ............................. 0.0.0.0
DNS server IP ............................. 0.0.0.0
Assisted Roaming Prediction List details:

Client Dhcp Required: True
Allowed (URL)IP Addresses
-------------------------

(Cisco Controller) >show client detail ec:59:e7:e9:e5:68
Client MAC Address............................... ec:59:e7:e9:e5:68
Client Username ................................. N/A
AP MAC Address................................... 44:ad:d9:57:fd:20
AP Name.......................................... AP-INDE-106
AP radio slot Id................................. 0
Client State..................................... Associated
Client NAC OOB State............................. Access
Wireless LAN Id.................................. 1
Hotspot (802.11u)................................ Not Supported
BSSID............................................ 44:ad:d9:57:fd:20
Connected For ................................... 3043 secs
Channel.......................................... 11
IP Address....................................... 192.168.0.162
Gateway Address.................................. Unknown
Netmask.......................................... Unknown
Association Id................................... 4
Authentication Algorithm......................... Open System
Reason Code...................................... 1
Status Code...................................... 0
Session Timeout.................................. 15000
Client CCX version............................... No CCX support
QoS Level........................................ Silver
Avg data Rate.................................... 0
Burst data Rate.................................. 0
Avg Real time data Rate.......................... 0
Burst Real Time data Rate........................ 0
802.1P Priority Tag.............................. disabled
CTS Security Group Tag........................... Not Applicable
KTS CAC Capability............................... No
WMM Support...................................... Enabled
APSD ACs....................................... BK BE VI VO
Power Save....................................... ON
Current Rate..................................... m7
Supported Rates.................................. 5.5,11.0,6.0,9.0,12.0,18.0,
............................................. 24.0,36.0,48.0,54.0
Mobility State................................... Local
Mobility Move Count.............................. 0
Security Policy Completed........................ Yes
Policy Manager State............................. RUN
Policy Manager Rule Created...................... Yes
Audit Session ID................................. none
AAA Role Type.................................... none
Local Policy Applied............................. none
IPv4 ACL Name.................................... none
FlexConnect ACL Applied Status................... Unavailable
IPv4 ACL Applied Status.......................... Unavailable
IPv6 ACL Name.................................... none
IPv6 ACL Applied Status.......................... Unavailable
Layer2 ACL Name.................................. none
Layer2 ACL Applied Status........................ Unavailable
mDNS Status...................................... Disabled
mDNS Profile Name................................ none
No. of mDNS Services Advertised.................. 0
Policy Type...................................... N/A
Encryption Cipher................................ None
Protected Management Frame ...................... No
Management Frame Protection...................... No
EAP Type......................................... Unknown
FlexConnect Data Switching....................... Local
FlexConnect Dhcp Status.......................... Local
FlexConnect Vlan Based Central Switching......... No
FlexConnect Authentication....................... Central
Quarantine VLAN.................................. 0
Access VLAN...................................... 321
Client Capabilities:
CF Pollable................................ Not implemented
CF Poll Request............................ Not implemented
Short Preamble............................. Implemented
PBCC....................................... Not implemented
Channel Agility............................ Not implemented
Listen Interval............................ 1
Fast BSS Transition........................ Not implemented
Client Wifi Direct Capabilities:
WFD capable................................ No
Manged WFD capable......................... No
Cross Connection Capable................... No
Support Concurrent Operation............... No
Fast BSS Transition Details:
Client Statistics:
Number of Bytes Received................... 13499
Number of Bytes Sent....................... 7662
Total Number of Bytes Sent................. 7662
Total Number of Bytes Recv................. 13499
Number of Bytes Sent (last 90s)............ 0
Number of Bytes Recv (last 90s)............ 0
Number of Packets Received................. 184
Number of Packets Sent..................... 69
Number of Interim-Update Sent.............. 0
Number of EAP Id Request Msg Timeouts...... 0
Number of EAP Id Request Msg Failures...... 0
Number of EAP Request Msg Timeouts......... 0
Number of EAP Request Msg Failures......... 0
Number of EAP Key Msg Timeouts............. 0
Number of EAP Key Msg Failures............. 0
Number of Data Retries..................... 61
Number of RTS Retries...................... 0
Number of Duplicate Received Packets....... 2
Number of Decrypt Failed Packets........... 0
Number of Mic Failured Packets............. 0
Number of Mic Missing Packets.............. 0
Number of RA Packets Dropped............... 0
Number of Policy Errors.................... 0
Radio Signal Strength Indicator............ -70 dBm
Signal to Noise Ratio...................... 18 dB
Client Rate Limiting Statistics:
Number of Data Packets Recieved............ 0
Number of Data Rx Packets Dropped.......... 0
Number of Data Bytes Recieved.............. 0
Number of Data Rx Bytes Dropped............ 0
Number of Realtime Packets Recieved........ 0
Number of Realtime Rx Packets Dropped...... 0
Number of Realtime Bytes Recieved.......... 0
Number of Realtime Rx Bytes Dropped........ 0
Number of Data Packets Sent................ 0
Number of Data Tx Packets Dropped.......... 0
Number of Data Bytes Sent.................. 0
Number of Data Tx Bytes Dropped............ 0
Number of Realtime Packets Sent............ 0
Number of Realtime Tx Packets Dropped...... 0
Number of Realtime Bytes Sent.............. 0
Number of Realtime Tx Bytes Dropped........ 0
Nearby AP Statistics:
AP-INDE-120(slot 0)
antenna0: 36159 secs ago................. -98 dBm
antenna1: 36159 secs ago................. -97 dBm
AP-INDE-115(slot 0)
antenna0: 11075 secs ago................. -96 dBm
antenna1: 11075 secs ago................. -96 dBm
AP-INDE-108(slot 0)
antenna0: 188 secs ago................... -96 dBm
antenna1: 188 secs ago................... -95 dBm
AP-INDE-106(slot 0)
antenna0: 188 secs ago................... -78 dBm
antenna1: 188 secs ago................... -67 dBm
AP-INDE-111(slot 0)
antenna0: 1451 secs ago.................. -98 dBm
antenna1: 1451 secs ago.................. -95 dBm
AP-INDE-119(slot 0)
antenna0: 188 secs ago................... -87 dBm
antenna1: 188 secs ago................... -95 dBm
AP-INDE-122(slot 0)
antenna0: 73165 secs ago................. -95 dBm
antenna1: 73165 secs ago................. -95 dBm
AP-INDE-105(slot 0)
antenna0: 188 secs ago................... -85 dBm
antenna1: 188 secs ago................... -86 dBm
AP-INDE-109(slot 0)
antenna0: 332 secs ago................... -91 dBm
antenna1: 332 secs ago................... -89 dBm
AP-INDE-121(slot 0)
antenna0: 2708 secs ago.................. -98 dBm
antenna1: 2708 secs ago.................. -96 dBm
AP-INDE-126(slot 0)
antenna0: 215 secs ago................... -84 dBm
antenna1: 215 secs ago................... -86 dBm
AP-INDE-116(slot 0)
antenna0: 188 secs ago................... -61 dBm
antenna1: 188 secs ago................... -61 dBm
AP-INDE-112(slot 0)
antenna0: 187 secs ago................... -83 dBm
antenna1: 187 secs ago................... -85 dBm
AP-INDE-107(slot 0)
antenna0: 188 secs ago................... -89 dBm
antenna1: 188 secs ago................... -90 dBm
AP-INDE-118(slot 0)
antenna0: 188 secs ago................... -95 dBm
antenna1: 188 secs ago................... -98 dBm
AP-INDE-114(slot 0)
antenna0: 187 secs ago................... -83 dBm
antenna1: 187 secs ago................... -85 dBm
AP-INDE-113(slot 0)
antenna0: 38981 secs ago................. -94 dBm
antenna1: 38981 secs ago................. -95 dBm
AP-INDE-123(slot 0)
antenna0: 187 secs ago................... -73 dBm
antenna1: 187 secs ago................... -65 dBm
AP-INDE-117(slot 0)
antenna0: 11013 secs ago................. -94 dBm
antenna1: 11013 secs ago................. -97 dBm
AP-INDE-103(slot 0)
antenna0: 187 secs ago................... -70 dBm
antenna1: 187 secs ago................... -80 dBm
AP-INDE-104(slot 0)
antenna0: 214 secs ago................... -95 dBm
antenna1: 214 secs ago................... -91 dBm
AP-INDE-102(slot 0)
antenna0: 215 secs ago................... -87 dBm
antenna1: 215 secs ago................... -88 dBm
AP-INDE-100(slot 0)
antenna0: 11014 secs ago................. -96 dBm
antenna1: 11014 secs ago................. -96 dBm
AP-INDE-101(slot 0)
antenna0: 11013 secs ago................. -96 dBm
antenna1: 11013 secs ago................. -95 dBm
DNS Server details:
DNS server IP ............................. 0.0.0.0
DNS server IP ............................. 0.0.0.0
Assisted Roaming Prediction List details:

Client Dhcp Required: True
Allowed (URL)IP Addresses
-------------------------