topic 8500 runnning 8.1.102.0 code. in Wireless

802.1x Session Re-authentication timeout and DHCP

kanansimpson — Mon, 05 Jul 2021 11:31:04 GMT

Hello,

Has anyone experienced an issue with wireless client IP renewal on a 802.1x enabled WLAN/SSID when the Re-authentication timeout occurs?

Here is the issue..

I have a dot1x enabled WLAN. I have some wireless clients (a mixture/not the same) that will lose it's IP address after the Re-authentication timeout occurs. When this occurs, the client remains connected to the ap but will eventually show an APIPA address. I have enabled client debug on the the WLC and see that the client reauth logs after the timeout occurs. I know the reauth is fine (Client remains connected to ap). I've done several pcaps and it indicates that the DHCP server is receiving the Discover packet and replying with the Offer. However, the last place I see the offer packet is at the WLC up link port. From there, its not getting to the client to complete the process.

By default, the Re-authentication timeout is configured for 30 mins (or 1800 secs). As a work around, I've increase the Re-authentication timeout value to 12 hours. A 30 minute disconnect is not acceptable.

Has anyone experienced this issue or know anything about it?

Thanks Kindly.

Hello

George Stefanick — Wed, 20 Jan 2016 19:47:32 GMT

Hello

I can't say I've seen this issue during a re auth the client loses its IP address. Can you move this back to 30 mins, capture a client debug and post ?

George,

kanansimpson — Wed, 20 Jan 2016 19:57:22 GMT

George,

First, I would give a disclaimer and let you know that I'm new to Cisco Wireless and learning it. With that said, you are referring to the debug client <mac> on the wlc cli, correct? I'm not able to move the timer back to the 30 minute value on the WLAN but I have create a duplicate WLAN that using the same L3 network for testing. I have the timeout value set to 5 minutes (300).

Thanks,

No problem. We all have to

George Stefanick — Wed, 20 Jan 2016 20:34:33 GMT

No problem. We all have to start somewhere. I manage a very large wireless network. 30,000 clients plus+. Im pretty well aware of all the little crazy things that can happen.

Fine, create another WLAN see, move to a shower timer and see if you can reproduce the issue. On the CLI in the WLC the client is attached to do a client debug <mac address>. When it disconnects and tries to reconnect we want to capture this...

George,

kanansimpson — Wed, 20 Jan 2016 21:22:09 GMT

George,

This is a capture that I already had. I've been tshooting this for a while now. Perhaps, I should disable dhcp proxy.

Please take a look.

Thanks,

What controller model and

George Stefanick — Wed, 20 Jan 2016 21:27:01 GMT

What controller model and code are you on ?

8500 runnning 8.1.102.0 code.

kanansimpson — Wed, 20 Jan 2016 21:29:29 GMT

8500 runnning 8.1.102.0 code. Planning to upgrade to 8.1.131.0 in the next few months.

On the controller CLI do a -

George Stefanick — Wed, 20 Jan 2016 21:31:57 GMT

On the controller CLI do a ->show wlan <X>

and post it

Do you have 2 DHCP servers

George Stefanick — Wed, 20 Jan 2016 21:43:28 GMT

Do you have 2 DHCP servers configured of your interface ?

Let me take a look at the WLAN config. Also do post the interface this WLAN is configured to. In the CLI do:

show interface detailed <name of interface>

server id: <DHCP_SVR_1> rcvd server id: <DHCP_SVR_1>

server id: <DHCP_SVR_2>  rcvd server id: <DHCP_SVR_2>

Here is the output for the

kanansimpson — Wed, 20 Jan 2016 21:45:42 GMT

Here is the output for the WLAN.

Thanks

Post

George Stefanick — Wed, 20 Jan 2016 21:51:38 GMT

Post

show interface detailed test-wifi-1010

Yes, We have two DHCP servers

kanansimpson — Wed, 20 Jan 2016 21:54:07 GMT

Yes, We have two DHCP servers.

Interface Name................................... test-wifi-1010
MAC Address...................................... 10:05:ca:bf:a1:ad
IP Address....................................... <_WLC_VLAN_1010_Interface>
IP Netmask....................................... <VLAN_1010_Gateway>
IP Gateway....................................... <_Client_VLAN_1010_Gateway>
External NAT IP State............................ Disabled
External NAT IP Address.......................... 0.0.0.0
VLAN............................................. 1010
Quarantine-vlan.................................. 0
NAS-Identifier................................... CiscoWLC
Active Physical Port............................. LAG (8)
Primary Physical Port............................ LAG (8)
Backup Physical Port............................. Unconfigured
DHCP Proxy Mode.................................. Disabled
Primary DHCP Server.............................. <DHCP_SVR_1>
Secondary DHCP Server............................ <DHCP_SVR_2>
DHCP Option 82................................... Disabled
DHCP Option 82 bridge mode insertion............. Disabled
IPv4 ACL......................................... Unconfigured
mDNS Profile Name................................ Unconfigured
AP Manager....................................... No
Guest Interface.................................. N/A
3G VLAN.......................................... Disabled
L2 Multicast..................................... Enabled

Thanks,

Do a show run of the SVI

George Stefanick — Wed, 20 Jan 2016 21:56:12 GMT

Do a show run of the SVI interface for this VLAN, 1010.

I posted the WLAN output

kanansimpson — Wed, 20 Jan 2016 21:59:12 GMT

I posted the WLAN output above. I will note that I disable the dhcp proxy on theis wlan and put IP helpers on the gateway interface. However, some WLANs are still using it and it still enabled globally.

Thanks,

Whats handing out your DHCP .

George Stefanick — Wed, 20 Jan 2016 21:59:28 GMT

Whats handing out your DHCP .. ?

interface Vlan1010 vrf member

kanansimpson — Wed, 20 Jan 2016 22:02:43 GMT

interface Vlan1010
vrf member hallnet
no ip redirects
ip address <ip addr2>
no ipv6 redirects
ip router ospf 1 area 0.0.0.0
hsrp version 2
hsrp 1010
priority 255
ip <ip_addr1>
ip dhcp relay address <DHCP_SVR_1>
ip dhcp relay address <DHCP_SVR_2>
description WLCStudentNet
no shutdown

Both IPs are defined as relays/helpers.

Here is where the breakdown

George Stefanick — Wed, 20 Jan 2016 22:18:18 GMT

Here is where the breakdown is as I see it.

Did this ever work and stopped working ? Did you do a code upgrade recently ? Any changes ?

Im not sure what this mean. But I think this is a logging bug and not your issue based on what i read.

[PA] Wired client head is NULL, no clients in the list. Number of clients = 0

*DHCP Socket Task: Nov 10 10:48:30.548: [PA] a0:63:91:87:4c:90 DHCP processing DHCP ACK (5)
*DHCP Socket Task: Nov 10 10:48:30.548: [PA] a0:63:91:87:4c:90 DHCP   op: BOOTREPLY, htype: Ethernet, hlen: 6, hops: 1
*DHCP Socket Task: Nov 10 10:48:30.548: [PA] a0:63:91:87:4c:90 DHCP   xid: 0xd5488f16 (3578302230), secs: 0, flags: 0
*DHCP Socket Task: Nov 10 10:48:30.548: [PA] a0:63:91:87:4c:90 DHCP   chaddr: a0:63:91:87:4c:90
*DHCP Socket Task: Nov 10 10:48:30.548: [PA] a0:63:91:87:4c:90 DHCP   ciaddr: <Wireless_Client_IP>,  yiaddr: 0.0.0.0
*DHCP Socket Task: Nov 10 10:48:30.548: [PA] a0:63:91:87:4c:90 DHCP   siaddr: 0.0.0.0,  giaddr: <_Client_VLAN_1010_Gateway>
*DHCP Socket Task: Nov 10 10:48:30.548: [PA] a0:63:91:87:4c:90 DHCP   server id: <DHCP_SVR_2>  rcvd server id: <DHCP_SVR_2>
*Apf Guest: Nov 10 10:48:56.650: [PA] Wired client head is NULL, no clients in the list. Number of clients = 0

Are all the clients acting

George Stefanick — Wed, 20 Jan 2016 22:18:53 GMT

Are all the clients acting like this ?

This is a new deployment. No

kanansimpson — Wed, 20 Jan 2016 22:20:40 GMT

This is a new deployment. No change in code. Always been an issue until I increase the session timer. The issue is still there. It's just every 12 hours and not every 30 minutes. This doesn't occur for everyone.

I just know when the session times out, the client does a reauth but eventually loses its IP. If I do a ipconfig/release and /renew, it will not obtain an IP address. If i disconnect from the wireless and reconnect, the device is able to obtain an IP. It seems that a client has to create a new session by disconnecting and reconnecting in order to get an IP.

Thanks,

see above post.Thanks

kanansimpson — Wed, 20 Jan 2016 22:21:09 GMT

see above post.

Thanks