2504 WLC and DHCP on separate VLAN

[Alan Richtmyer]

Hello,

My problem, in a nutshell, is that clients do not get an IP from an external DHCP server when connected to a guest VLAN.

My current setup is:

Native VLAN 1 (192.168.2.x)

2008 DHCP Servers

2504 WLC

5 AP1142

ASA5510 routing between the VLANs and configured as a DHCP relay

VLAN 101 (192.168.6.x)

Guest Network

There are other VLANs as well, but they arent involved yet.

I have a couple AP1142s in autonomous mode currently, each configured with SSIDs in different VLANs.

Everything works great with them. All clients receive an IP based on the VLAN for the SSID.

So now I want to expand the wireless coverage and add more APs and the WLC...

Ive kept the 2504 config simple to start.

The management interface is configured on the native VLAN.

Any WLANs set to that interface work great. Clients get an IP from a 2008 server.

A Dynamic interface is configured with VLAN 101

IP in the .6.x network

Gateway is the IP of VLAN101 interface on the ASA

DHCP Server is set to the IP of the 2008 server on VLAN 1

The guest WLAN just uses WPA and a PSK and is set to interface vlan101

There rest of the 2504 config is default.

The ports that the WLC and APs are connected to are tagged on the correct VLANs. (is that even necessary for the AP now?)

Ive changed the interface config around a hundred times now with no luck.

No matter what a client will not get an IP.

Could this be due to the 2504 and ASA both acting as DHCP relays?

Ive tried setting the IP of the DHCP on the dynamic interface to many different things with no luck.

Any thoughts about what Im missing here?

[Scott Fella]

Disable dhcp proxy on the wlc and see if that works.

Sent from Cisco Technical Support iPhone App

[Alan Richtmyer]

It was disabled by default, but I double checked again and its disabled.

[ranjitdulceuno]

Check out the firewall settings...

Refer the link i hope it will help you

https://supportforums.cisco.com/thread/2147632

Sent from Cisco Technical Support iPhone App

[Alan Richtmyer]

What firewall settings on which device?

[Scott Fella]

A Dynamic interface is configured with VLAN 101

IP in the .6.x network

Gateway is the IP of VLAN101 interface on the ASA

DHCP Server is set to the IP of the 2008 server on VLAN 1 <--- Are you routing vlan 101 traffic to be allowed to access vlan 1?

[Alan Richtmyer]

Im only allowing access to a couple VLAN1 printers, other than that though VLAN101 has no access to VLAN1.

Earlier though I did add a few ACL entries to see if that was the problem - I created a permit rule for a DHCP server, the 2504 and the one AP thats connected.

It did not help.

I wouldn't have thought an ACL would be required though since the APs I have running in autonomous mode assign IPs to users on all VLANs.

[Scott Fella]

Well your gateway is the ASA, so the ASA has to allow dhcp.

[Alan Richtmyer]

I would have thought the same thing, but its never been required in the past.

I assumed the ASA allowed it since it was running a DHCP relay for those VLANs.

(maybe Im wrong here, but it worked well for a year now so I left it as such)

But just now for testing purposes I created the ACLs permitting IP for the DHCP server, as well as the WLC and AP

I then tested the access list by removing my LAN cable, and connecting to our existing Guest network.

I received an IP in the 6.x VLAN101 network like I always do and can now ping the DHCP server, WLC and AP successfully, but nothing else in VLAN1.

So communication is great between all devices.

But now I switch my wireless to the Test Guest network on the WLC and I do not get an IP.

If I give myself a static IP in VLAN101 (192.168.6.5) I can access the internet fine and cannot access anything in VLAN1 that I dont specifically have an ACL for.

Great! Everything seems to work fine as far as network configuraiton goes, but I still cannot get an IP if I set the client to DHCP

Thanks for all the help so far!

Once the smartnet is processed I guess I'll end up opening a TAC case, but was hoping to have this setup by tomorrow.

[Erik Boss]

When optaining an IP-address, please use the monitoring function in ASDM or add a capture on the firewall.

You should see DHCP requests.

Thought about NAT exempts / NAT0?

You want to ping from your GuestLAN to a server in your vlan 1? Why?

It's a security issue when obtaining an IP-address from a production server for you Guestvlan.

I would use the WLC or an other DHCP-server (internet router).

[Alan Richtmyer]

I dont want to ping anything in VLAN1, I just want to get an IP from the DHCP servers there and not have to manage multiple different DHCP servers.

Using the ASA to route between VLANs I dont even have to create an ACL to allow DHCP, it just works when DHCP relay is enabled, so I dont see the security risk there.

All other communication is blocked completely except for 2 printers and it works great.

So it turns out the problem was having both autonomous APs and LWAPs with a WLC all on the same VLAN.

I created a separate test VLAN and moved the WLC and APs there, and also did have to enable DHCP proxy, then clients started receiving IP addresses.