2802e Wireless Clients Connect to WLAN, get IP from DHCP, but cannot ping gateway or get internet access

[cfc]

After 2 days straight of research and troubleshooting I have reached a point where I am completely stumped and need assistance.

I have a Catalyst 3850 switch running Denali 16.3.6. It is running as the MC and has 2 Aironet 2802E APs connected to access ports configured to the VLAN of the Mobility Controller. I have not set up any ACLs yet just to rule them out, and I am using the switch as a DHCP server for each VLAN I have configured on it. The router is not Cisco but the necessary static routes have been configured to get access to the internet.

So, both APs get their DHCP assignment from the switch, and from the console port of either AP I am able to run successful pings to any IP I have set on the switch and 8.8.8.8.

From the switch I can ping 8.8.8.8 and the APs.

I connected a PC to a trunk port and manually assigned a VLAN in the NIC. It gets an IP from DHCP and is able to ping its gateway and 8.8.8.8

I have set up a WLAN configured on the same VLAN as the aforementioned PC. I connect a wireless device on the WLAN, it authenticates and gets an IP in the correct subnet from DHCP. However, that is where it ends. I cannot ping the gateway IP, the IP of the PC, 8.8.8.8, anything.

Any thoughts as to what could be causing this to happen?

[Rasika Nayanajith · Accepted solution]

Hi

Hope you follow basic config guide like below

https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-vlan/116342-config-wlc-00.html

See if enabling DHCP snooping make any difference ?

Also try 16.3.7 & see if problem remain same or not.

HTH

Rasika

*** Pls rate all useful responses ***

Rasika

[cfc]

DHCP snooping on the VLANs with DHCP did it, thank you so much! Though I still don't fully understand DHCP Snooping or why it was necessary for this to work, all that I can find on it says that it is recommended but optional. Apparently not optional with WLAN. Wish they would put that in documentation somewhere. Oh well, needed to enable this anyways for dynamic ARP inspection.