topic Re: C1200: DHCP problem with VLANs in Wireless

C1200: DHCP problem with VLANs

jbkilpatrick — Sun, 04 Jul 2021 17:10:17 GMT

After upgrading to the new 12.3(2)JA firmware, my clients are no longer able to receive IP addresses from the DHCP server on any VLAN other than the default VLAN.

My environment is a Cisco 1200 with 2 VLANs. There are two SSIDs, OPEN1 & OPEN2. Neither SSID has any security. The C1200 is plugged into a switch on with 2 VLANs set up as follows:

Port 1 = VLAN1 (port1-tagged, port2-untagged)

Port 2 = VLAN2 (port2-tagged, port2-tagged)

DHCP server with 2 VLANS on port 1 of the switch and the C1200 on port 2 on the switch. Two scopes on the DHCP, one for each VLAN.

With the 12.2(15)XR2, this setup works fine. Clients get an IP address on either SSID and it matches the appropriate VLAN.

Was some thing changed in the new firmware in the way VLANs behave with DHCP? Any ideas?

Re: C1200: DHCP problem with VLANs

rpaquin — Wed, 17 Nov 2004 18:57:52 GMT

ditto here also,

reduced the config to base config but as soon as you configure multiple vlans, dhcp forwarding fails.

we sat here with a ccie for 3 hrs trying to figure out what might have changed with the new code.. I think we're waiting for 12.3.2-ja1 on this one. already a ja1 for 1400 bridges..

Re: C1200: DHCP problem with VLANs

dixho — Wed, 17 Nov 2004 19:54:14 GMT

I doubt that the problem is fixed in 12.3.2(JA1) because there is no bug opened for this problem. I try to recreate the problem in my lab. I use an AP1200 running 12.2(3)JA. My configuration is as follows:

ap#sh run

Building configuration...

Current configuration : 2733 bytes

version 12.3

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

service password-encryption

hostname ap

enable secret xxxx

username Cisco password xxxx

ip subnet-zero

no aaa new-model

bridge irb

interface Dot11Radio0

no ip address

no ip route-cache

ssid dixho

vlan 2

authentication open

ssid dixho106

vlan 106

authentication open

short-slot-time

speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0

54.0

power local cck 1

power local ofdm 1

station-role root

no cdp enable

interface Dot11Radio0.2

encapsulation dot1Q 2

no ip route-cache

bridge-group 2

bridge-group 2 subscriber-loop-control

bridge-group 2 block-unknown-source

no bridge-group 2 source-learning

no bridge-group 2 unicast-flooding

bridge-group 2 spanning-disabled

interface Dot11Radio0.106

encapsulation dot1Q 106 native

no ip route-cache

bridge-group 1

bridge-group 1 spanning-disabled

interface Dot11Radio1

no ip address

no ip route-cache

shutdown

ssid dixho

vlan 2

authentication open

ssid dixho106

vlan 106

authentication open

speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0

station-role root

no cdp enable

interface Dot11Radio1.2

encapsulation dot1Q 2

no ip route-cache

bridge-group 2

bridge-group 2 subscriber-loop-control

bridge-group 2 block-unknown-source

no bridge-group 2 source-learning

no bridge-group 2 unicast-flooding

bridge-group 2 spanning-disabled

interface Dot11Radio1.106

encapsulation dot1Q 106 native

no ip route-cache

bridge-group 1

bridge-group 1 spanning-disabled

interface FastEthernet0

no ip address

no ip route-cache

duplex auto

speed auto

interface FastEthernet0.2

encapsulation dot1Q 2

no ip route-cache

bridge-group 2

no bridge-group 2 source-learning

bridge-group 2 spanning-disabled

interface FastEthernet0.106

encapsulation dot1Q 106 native

no ip route-cache

bridge-group 1

no bridge-group 1 source-learning

bridge-group 1 spanning-disabled

interface BVI1

ip address 11.3.0.1 255.0.0.0

no ip route-cache

ip http server

no ip http secure-server

ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag

ip radius source-interface BVI1

logging snmp-trap emergencies

logging snmp-trap alerts

logging snmp-trap critical

logging snmp-trap errors

logging snmp-trap warnings

bridge 1 route ip

line con 0

transport preferred all

transport output all

line vty 0 4

transport preferred all

transport input all

transport output all

line vty 5 15

transport preferred all

transport input all

transport output all

end

ap#sh dot11 associations

802.11 Client Stations on Dot11Radio0:

SSID [dixho] :

MAC Address IP address Device Name Parent Stat

000e.9b26.7efb 192.168.2.11 350-client DIXHO-W2K02 self Assoc

SSID [dixho106] :

MAC Address IP address Device Name Parent Stat

0002.8ade.5f9a 11.4.0.8 350-client DIXHO-W2K self Assoc

I configure DHCP on both VLANs. A Windows server on VLAN 106 provides the DHCP server. A Catalyst 2970 provides DHCP function on VLAN 2.

I wonder if one of you can do debug dot11 dot11 0 trace print xmt rcv. This will turn the AP into wireless sniffer. From there, we should able to decode the DHCP request.

Re: C1200: DHCP problem with VLANs

jbkilpatrick — Wed, 17 Nov 2004 22:10:40 GMT

This is a capture from VLAN02. I stopped it after the client recieved a UPNP address (169.254.x.x). Hope this helps.

5AA06110 r 1 40 26- B000 13A 000CCEFF58A5 009096A362A3 000CCEFF58A5 0180 auth

algorithm 0

sequence 1

status 0

221 - 0 10 18 2 0 0

5AA065CF t 11 - B000 0D5 009096A362A3 000CCEFF58A5 000CCEFF58A5 D840 auth

algorithm 0

sequence 2

status 0

*Mar 1 00:33:20.462: %DOT11-6-ASSOC: Interface Dot11Radio0, Station 0090.96a3.62a3 Associated KEY_MGMT[NONE]

5AA0690A r 1 40 25- 0000 13A 000CCEFF58A5 009096A362A3 000CCEFF58A5 0190 assreq

cap 421 infra shorthdr

listen interval 10

ssid OPEN2

rates 82 84 8B 96

221 - 0 40 96 1 1 0

221 - 0 40 96 3 2

221 - 0 10 18 2 0 0

5AA07231 t 11 - 1000 075 009096A362A3 000CCEFF58A5 000CCEFF58A5 D850 assrsp

cap 421 infra shorthdr

status 0

aid C010

rates 82 84 8B 96

5AA073A8 t 11 - 0802 075 009096A362A3 000CCEFF58A5 000CCEFF58A5 D860 l54

IP 224.0.0.1 < 172.16.1.1 id 9F ttl255 sum 2E2E prot 2 len 28

EEFE 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

5AA0A8A0 r 11 39 26- 4811 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 01A0 null l0

5AA2C6C0 r 11 42 16- 4801 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 01B0 null l0

5AA2C9F2 r 11 40 22- 0801 075 000CCEFF58A5 009096A362A3 FFFFFFFFFFFF 01C0 l336

IP 255.255.255.255 < 0.0.0.0 id 6987 ttl128 sum D01E prot 11 len 328

0043 0134 EECB 0101 0600 B01F EE38 0000 0000 0000 0000 0000 0000 0000 0000

0000 0000 0090 96A3 62A3 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

5AA872B5 r 11 40 28- 4811 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 01D0 null l0

5AB04694 r 11 43 147- 4801 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 01E0 null l0

5AB04880 t 11 - 0802 075 009096A362A3 000CCEFF58A5 000D29FA4C99 D920 l58

SNAP GetInfo 1 0090.96a3.62a3 < 000d.29fa.4c99

0100 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

0000 0000

5AB68332 r 11 43 19- 4811 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 01F0 null l0

5AEEC085 r 11 44 35- 4809 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 0200 null l0

5AEEC494 r 11 44 32- 0801 075 000CCEFF58A5 009096A362A3 FFFFFFFFFFFF 0210 l336

IP 255.255.255.255 < 0.0.0.0 id 6988 ttl128 sum D01D prot 11 len 328

0043 0134 E9CB 0101 0600 B01F EE38 0500 0000 0000 0000 0000 0000 0000 0000

0000 0000 0090 96A3 62A3 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

5AF1EAE2 r 11 44 41- 4811 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 0220 null l0

5B782C83 r 11 40 22- 4809 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 0230 null l0

5B782FED r 11 40 24- 0801 075 000CCEFF58A5 009096A362A3 FFFFFFFFFFFF 0240 l336

IP 255.255.255.255 < 0.0.0.0 id 6989 ttl128 sum D01C prot 11 len 328

0043 0134 E0CB 0101 0600 B01F EE38 0E00 0000 0000 0000 0000 0000 0000 0000

0000 0000 0090 96A3 62A3 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

5B7B895F r 11 47 39- 4811 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 0250 null l0

5C5D22BC r 11 45 44- 4801 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 0260 null l0

5C5D452C r 11 48 40- 0801 075 000CCEFF58A5 009096A362A3 FFFFFFFFFFFF 0270 l336

IP 255.255.255.255 < 0.0.0.0 id 698A ttl128 sum D01B prot 11 len 328

0043 0134 D1CB 0101 0600 B01F EE38 1D00 0000 0000 0000 0000 0000 0000 0000

0000 0000 0090 96A3 62A3 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000

5C62D5D3 r 11 48 46- 4811 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 0280 null l0

5E54FB86 r 11 48 40- 4809 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 0290 null l0

5E54FEA2 r 11 48 31- 0801 075 000CCEFF58A5 009096A362A3 FFFFFFFFFFFF 02A0 l36

ARP1 hdw 1 prot 800 0090.96a3.62a3 169.254.171.36 > 0000.0000.0000 169.254.171.36

5E5503BD t 11 - 0802 000 FFFFFFFFFFFF 000CCEFF58A5 009096A362A3 0E20 l50

ARP1 hdw 1 prot 800 0090.96a3.62a3 169.254.171.36 > 0000.0000.0000 169.254.171.36

5E5A3846 r 11 48 38- 4811 0D5 000CCEFF58A5 009096A362A3 000CCEFF58A5 02B0 null l0

Re: C1200: DHCP problem with VLANs

jmagnusson — Fri, 19 Nov 2004 21:25:19 GMT

We have 350+ AP's - we had intermittent issues. Some people got ip addresses and some didnt. Some Ap's they would and some wouldn't. Had to back out - I opened a case and recommended they pull it off the website - I would advise against applying this code.

We have multiple vlans also but it was not cut and dry. Some instances a reboot would fix it.

Re: C1200: DHCP problem with VLANs

dmford — Fri, 19 Nov 2004 22:30:45 GMT

We are seeing the same issue intermittently with 12.2(15)XR2. We upgraded to 12.3(2)JA and the problem appears more frequently. We have been working with Cisco and Microsoft on this for days now. When is CISCO going to get their PEAP wireless code working properly? New IOS's every week it seems.

Re: C1200: DHCP problem with VLANs

dixho — Sat, 20 Nov 2004 01:41:40 GMT

"When is CISCO going to get their PEAP wireless code working properly?" Do you mean the ADU for CB21AG or IOS for AP?

Re: C1200: DHCP problem with VLANs

sojelade — Mon, 22 Nov 2004 18:08:36 GMT

I am running PEAP and had similar problems. After upgrading to the new 12.3(2)JA firmware, my clients are no longer able to receive IP addresses from the DHCP server on any VLAN other than the default VLAN.

When I upgraded to the latest client software this problem was resolved. I have not yet tried the PEAP autentication to see if there is a problem. My 350 client cards seams not to be affected while all my CB21AG cards will not recieve IP address from the DHCP server.

Re: C1200: DHCP problem with VLANs

jmagnusson — Mon, 22 Nov 2004 20:26:20 GMT

I urge all customers with this issue to open a TAC Service Request so cisco can get enough info to open a bug or remove this code from the website..

They are trying to recreate the problem - my TAC Service Request Number is 600716875 for reference.

Re: C1200: DHCP problem with VLANs

gpnexusis — Tue, 23 Nov 2004 02:14:24 GMT

I was experiencing this problem with 12.2(15)JA4 code too and upgraded all the way to 12.3 and find my integrated Intel 2100 and 2200BG wireless works very intermittently or not at all. They associate just fine but they do not get an IP address from the DHCP server. Found with a Sniffer trace that our APs do not even put the packet on the wired network. We are not currently using vlans. The local integrator brought over an a/b/g card from Cisco and it works great. Haven't had a problem yet. Opened a case with Cisco last Thursday and they are looking for answers. I will reference this ticket number and see if it helps.

Re: C1200: DHCP problem with VLANs

rpaquin — Tue, 07 Dec 2004 20:54:46 GMT

this is an official bug on this

CSCsa44872 DHCP requests fail from non-native VLAN on 12.3(2)JA

I quite frankly am appalled that this could have gotten thru the testing process and actually been released to public at large.

it took me one access point and less than 1 hour to realize that this code was doa.

it shouldn't be that easy to find a bug in a production release of code.

That is a fairly large (ok, try huge) bug to pop up.

what is even more appalling is that the code is still available and no notice has been put in either the readme or a special notice in that section.

Cisco, your seriously slipping. very seriously.

(and I'm not even gonna start on the three logins, the export notice and the 6 pages you have to go thru to download the darn code... try eliminating some of those steps geez, I know someone patented the one click process, but 5?)

Re: C1200: DHCP problem with VLANs

dixho — Wed, 08 Dec 2004 02:22:19 GMT

Thanks for your feedback. I will forward your feedback to the corresponding engineering team.

I have been trying to reproduce the problem in my lab for the last 2 weeks. I cannot reproduce the problem.

I copied one of the customer's AP configuration into an AP in my lab. The switch configuration is almost identical.

I know that there are several engineers in Cisco doing the same thing. So far, there is only one TAC engineer in Brussel able to reproduce the problem. The Development Engineer is working with the Brussel TAC engineer now. Because of time difference between San Jose and Brussel, it will be helpful to reproduce the problem in US.

I appriciate if anyone can help me on this and send me an e-mail. If you can give me access to a test AP experiencing the problem, that will be helpful. I would like to run some debugs on the test AP.

Re: C1200: DHCP problem with VLANs

dixho — Sat, 11 Dec 2004 03:16:51 GMT

We know how to recreate the problem. I update the release notes of CSCsa44872. For those who do not have access to bug toolkit, below is the updated release notes:

Symptons: When an Cisco APs are running IOS version 12.3(2)JA, clients are unable to receive DHCP assigned IP address

Condition: VLANs are configured on the AP. Wireless clients are associating to any non-native VLAN. The AP drops the DHCP offer from the DHCP server if the DHCP offer frame is a broadcast. Usually, this occurs when the wireless clients and the DHCP server are on the same broadcast domain (i.e. same VLAN)

Workaround :

1. Downgrade to IOS revision 12.2(15)XR2

2. Configure "ip helper-address" on a router on the same VLAN as the DHCP and wireless clients. Note that a PIX cannot be a workaround.

Re: C1200: DHCP problem with VLANs

scottmac — Sat, 11 Dec 2004 16:23:12 GMT

This kind of bug has been in-and-out since (at least)the last version of VxWorks.

I had a customer with this problem on VxWorks, they upgraded to IOS and it corrected the problem (until they upgraded the IOS, then it was back, then they upgraded again, it went away.

The problem was sent to the DE (DE = "Black Hole, from which no information ever escapes").

From a little work on my own, it appears to be a memory / stack overlap that hits (and corrupts) part of the VLAN maintenance information. It used to be associated with higher-level encryption / auth. (i.e, the auth table / stacks overlap / hit / interfere with the VLAN info).

If you do a capture at each point (AP Ethernet, DHCP server interface, and a router or two along the way), you'll see the DHCP request make it all the way to the server and back .... when the DHCP response hits the AP, the AP doesn't find a VLAN association for that request so it gets dropped into the Native VLAN. (i.e., request goes out on VLAN 400, stays on 400 to-and-from the DHCP server until the AP, where it comes out on the Native VLAN).

This problem (for my customer) was taken to the TAC over a year ago (~15 months). It went to the DE and was never heard of again.

Check with Ramya @ SJ TAC. She handled the case. It was in Columbus OH.

Since the problem occurred just down the street from Aironet in Columbus, they sent a team to the site and confirmed the problem as described.

Perhaps the old information will help with the "new" problem.

FWIW

Scott

Re: C1200: DHCP problem with VLANs

jmagnusson — Mon, 13 Dec 2004 16:38:45 GMT

Scott,

Thanks for the info.. I knew you had it in you..

Dixho,

Look at the posts for the past 3 weeks... you customers told Cisco this was bad code and should be pulled... this bug has caused grief for many people. There is another bug also that I have that I cant post I dont think - they said it is an internal bug. My PA's worked for hours then all of a sudden they wouldnt process DHCP requests - A TX buffer getting wedged... Is cisco pulling the code now?

Re: C1200: DHCP problem with VLANs

jmagnusson — Mon, 13 Dec 2004 16:39:10 GMT

Scott,

Thanks for the info.. I knew you had it in you..

Dixho,

Re: C1200: DHCP problem with VLANs

dixho — Tue, 14 Dec 2004 00:35:49 GMT

Your comment has been forwarded to the Director in the corresponding engineering team. The Product Manager and the Director will make a decision.

Re: C1200: DHCP problem with VLANs

clay.white — Tue, 14 Dec 2004 19:50:27 GMT

I was experiencing this same issue. Once I configured an IP Helper Address on the vlan routing interface, I immediately was able to obtain a DHCP address. Incidentally, the DHCP server is on that same vlan. I did not have to backgrade the software version to fix this issue.