WLC 5508 - DHCP unable to provide IPs to a specific ssid only

punithrameshofficial · ‎05-15-2023

Hi Everyone ,

This issue has been bothering our corporate environment for a while now . any help would be great .

We recently upgraded the ios on the 5508 controller at the DC1 - this is the one that we primarily use for a bunch of sites. We have a sub sea site which has issues with only one specific SSID - ( WLAN e14 ) - this same SSID is being broadcasted at other sites too which are connected to the same controller and has been working fine. all the clients trying to connect to the AP are working as intended and receive an ip address.

this specific site only has access issues - the end clients are not able to connect to the WLAN - and get a failed message.

Upon digging the logs with TAC, the issue seems to be that the clients are not able to receive any IP from the DHCP server setup on the environment.

the current code running on the WLC is 8.5.171- all other SSID's are working as intended.

Flavio Miranda · ‎05-15-2023

Hi

Where is the DHCP server? It is local to this site or on the Data Center? Not able to connect to a wlan and dont get IP address are different problems. You can connect to a wlan and not receive IP address.

punithrameshofficial · ‎05-15-2023

Hi @Flavio Miranda

We have a DCHP server locally and one in the DC - For this SSID the Requests are going to the DC and not the local DHCP server
On the client end - it shows limited connectivity , and does not work as intended .
on the wlc end the client MAC shows as 0.0.0.0 as the ip address

Flavio Miranda · ‎05-16-2023

One more question. This Wlan is local mode, right? As it gets IP on the DC and not local.

If thats the case, I mean, all the traffic for this SSID is sent to the WLC first via capwap tunnel, the DHCP request is made from the DC.

You need to check what this wlan have different. You probably have an AP group for this site, and on the AP group this Wlan is associated to one dynamic interfaces or interface group. Check this config.

Make more sense to me that the AP group has a dynamic interface and something is not right on this interface.

If you dont have DHCP proxy enable on the WLC, check if the dynamic interface have the IP address of the DHCP server on it.

And check the layer3 who has this interface vlan. It might have IP helper address on it. Make sure it have and it is pointing to the right server.

Lastly, which dhcp server ids it? Can you access and see logs?

Flavio Miranda · ‎05-16-2023

One more question? This Wlan is local mode, right? As it gets IP on the DC and not local.

If thats the case, I mean, all the traffic for this SSID is sent to the WLC first via capwap tunnel, the DHCP request is made from the DC.

You need to check what this wlan have different. You probably have an AP group for this site, and on the AP group this Wlan is associated to one dynamic interfaces or interface group. Check this config.

Make more sense to me that the AP group has a dynamic interface and something is not right on this interface.

If you dont have DHCP proxy enable on the WLC, check if the dynamic interface have the IP address of the DHCP server on it.

And check the layer3 who has this interface vlan. It might have IP helper address on it. Make sure it have and it is pointing to the right server.

Lastly, which dhcp server ids it? Can you access and see logs?

punithrameshofficial · ‎05-16-2023

Hi @Flavio Miranda

The access points are in flex connect mode for this specific site ( The controller is a central controller serving all other locations too - which do not have this issue )

The authentication for the end clients go through the AP and the switching , the controller and reach the radius server get authenticated VIA ISE and Trying to fetch the IP from the DHCP server. )
I could be wrong multiple calls with TAC is going on for the same .

If you dont have DHCP proxy enable on the WLC, check if the dynamic interface have the IP address of the DHCP server on it. >> we have a working scenario in the same site - WLAN01 lets call it and it has the same DHCP server ip in the dynamic interface - but the authentication goes to the local DHCP server and not the one in the DC and successfully connects.

for the non working WLAN_E1 - this is destined to be used only for personal devices - has the same DCHP server ip in its dynamic interface but does not seem to try to fetch the ip from the local goes to the Server.

The layer three interface on the switch has IP helper addresses on it and are pointing to the right server .

We performed a bit of testing today by assigning a Static ip address to the end machine used for testing and the machine was able to connect to the AP and reflected under the clients section of the WLC , however it was not able to use the internet at all

Flavio Miranda · ‎05-16-2023

If the WLAN is local switch and the AP is in flexconnect then nothing that I said applie. On this case the DHCP for clients does not fo to DHCP and it entirely to the client get the IP address on the local network.

Now I will start think on the WLAN to VLAN mapping on the AP . And do you have DHCP snooting on the switch?

marce1000 · ‎05-15-2023

1) Preferably since the 5508 is getting old , use the last release that it can run : https://software.cisco.com/download/specialrelease/8f166c6d88b9f77aabb63f78affa9749
2) Have a checkup review of the controller configuration with this procedure :
https://community.cisco.com/t5/networking-knowledge-base/show-the-complete-configuration-without-breaks-pauses-on-cisco/ta-p/3115114#toc-hId-1039672820
Have the output analyzed by : https://cway.cisco.com/wireless-config-analyzer
3) Use client debugging according to https://www.cisco.com/c/en/us/support/docs/wireless/aironet-1200-series/100260-wlc-debug-client.html
You can have client debugs analyzed with : https://cway.cisco.com/wireless-debug-analyzer

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

punithrameshofficial · ‎05-16-2023

Thank you @marce1000
Will take a look and post

KhanAkhtar · ‎05-15-2023

It sounds like the issue is specific to the WLAN e14 at the sub sea site, and it may be related to DHCP. Here are a few troubleshooting steps that you could try:

Check the DHCP server configuration: Make sure that the DHCP server is configured correctly and that there are no issues with the IP address pool for the WLAN e14. You could try renewing the lease for a client that is having issues to see if that helps.
Check the WLAN configuration: Verify that the WLAN e14 is configured correctly on the WLC. Check the security settings and make sure that the correct VLAN is assigned to the WLAN.
Check the AP configuration: Make sure that the AP at the sub sea site is configured correctly and that it is connected to the correct VLAN. You could try rebooting the AP to see if that helps.
Check for interference: Interference from other devices could be causing issues with the WLAN e14 at the sub sea site. You could use a spectrum analyzer to check for any interference.
Check for any access control policies: Check if there are any access control policies in place that may be blocking access for clients to the WLAN e14.

If none of the above steps help resolve the issue, it may be necessary to open a case with TAC again and provide them with the troubleshooting steps that you have already taken. They may be able to provide additional guidance and support to help resolve the issue.

punithrameshofficial · ‎05-16-2023

Check the DHCP server configuration: Make sure that the DHCP server is configured correctly and that there are no issues with the IP address pool for the WLAN e14. You could try renewing the lease for a client that is having issues to see if that helps.

Answer : The DHCP server team confirms that the configuration is perfect and there are no issues with it, there are available IPs for the clients to connect, however there are no hits macs trying to connect to it.

2. Check the WLAN configuration: Verify that the WLAN e14 is configured correctly on the WLC. Check the security settings and make sure that the correct VLAN is assigned to the WLAN
ANS: This has also been verified , the WLAN e14 is properly configured and has the right VLAN allowed in it .
3.

Check the AP configuration: Make sure that the AP at the sub sea site is configured correctly and that it is connected to the correct VLAN. You could try rebooting the AP to see if that helps.
Ans: AP seems to be broadcasting the SSID properly and the users also get the authentication page- and just loads and not connect, the Ip on the WLC shows as 0.0.0.0 - Rebooting the AP is something we are trying to take a look at

Leo Laohoo · ‎05-16-2023

What APs are at this site, are they 1800/2800/3800/4800/1560?

punithrameshofficial · ‎05-16-2023

The aps at this site are 2802 model APs

Leo Laohoo · ‎05-17-2023

The issue is the model of the AP. The workaround is to reboot the AP. The fix is replace the AP with a different model.

There are several known bugs affecting 2800/3800/4800/1560 and it is all due to MARVEL radio chipset being used. Most of the time, the radio will just blackhole routine traffic like DHCP packets.

punithrameshofficial · ‎05-20-2023

Thank you Leo , for the Advice

A very confusing thing happened and currently the issue has been resolved but i'm still not satisfied with the resolution, looks to me like its a temporary Fix,

Back in February when we updated the code to 8.5.171 - all the locations connected to this controller ( in land and offshore ) were not able to connect to this specific SSID .

CISCO TAC recommended to Uncheck the option that says " DHCP assignment required " on the controller . and that fixed the issue for all the locations , and after about three days the offshore site had a problem with the SSID again. Since we had the issue until a couple of days ago. We unchecked the option and the offshore site that had the problem started working again.
Not really sure for how long this fix would be . very weird