I am running ISE and have "ip dhcp snooping vlan 1-1005" configured on access layer switches. Sometimes the wired guest CWA doesn't work. I found out that happens when the switch (or something) changes the above command from 1 range to 2 ranges effectively skipping the guest vlan. Like ip dhcp snooping vlan 1-599,601-1005. If I log on to the switch and change the range back to 1-1005 which includes the guest vlan 600, guest works again (until the next time it gets changed). What's causing the switch to change this command, and how to prevent it from happening?
