Wrong client IP with Flexconnect in VLAN1

[Ingénierie RCI]

Hi everyone,

I face a problem when replacing a 5504 physical controller with Cisco 1852 AP by a C9800-CL virtual controller in version 17.3.6 with Cisco 9120 AP.

Both controllers have an IP address on the same subnet of VLAN 1.
The VLAN configuration on the switches for the Access Points is as follows:
switchport trunk native vlan 240
switchport trunk allowed vlan 1-252
switchport mode trunk

All APs retrieve an IP in VLAN 240 from DHCP (old and new)
I have several SSIDs that point to several VLANs and to different subnet.
By connecting to the different SSIDs on the old controller, clients retrieve an IP from the correct network.
This is also the case on the new controller, except for SSIDs supposed to connect people in VLAN 1, which give a VLAN 240 address to the client, such as the Access Points.
We have defined the configuration in FlexConnect on each of the controllers.
The configuration between the two controllers is the same, but the problem only appears on the new C9800-CL.

In the FlexConnect Profile, the Native VLAN ID is 240, and in the VLAN section we have specified the VLANs associated with the SSIDs.
The impacted SSID is placed in VLAN ID 1.
We did the same for the Tags. The informed policy is the one associated with VLAN1

The VLAN configuration on the c9800 is as follows:
In Configuration -> Layer2 -> SVI , we declared VLAN1, without any particular configuration. Admin and Operational Status are Up.
We have also declared in Configuration -> Layer2 -> VLAN the VLAN1 to associate the corresponding interfaces on the VSwitch.

Could this duplicate VLAN1 configuration be a problem?

Is it possible to use VLAN 1 with FlexConnect on the C9800 ?

Or is this a bug or firmware version issue ? 

I remain available to provide additional information on the configuration.
Thank you in advance for your help.

Regards

[balaji.bandi]

I never had any experience using default VLAN1 i always avoid.

For testing replicate the settings using different VLAN (other 1) and TEST SSID and see if that works. if that works, then change as per the test outcome.,

[Ingénierie RCI]

Hi,

Thank you for your answer.
We tried to switch this SSID to another VLAN, it works fine, we get an address associated with it.
However, we need to use VLAN 1 to make access to internal resources accessible to users, and we face the same problem.

Regards,

[balaji.bandi]

 we need to use VLAN 1 to make access to internal resources accessible to users

what resources ? give some example in the IP formwat so we can understand, as long as the Routing able to reachable they can able to access ( as cisco always suggest avoid using default vlan 1 - for different reasons).