7920 DHCP problem

[andrew.brazier]

We have some 7920's that are successfully authenticating to an AP (LEAP with rotating WEP keys) but never get a DHCP address. DHCP server is a router on the same subnet and running DHCP debugs on it we don't see any evidence of the phones requesting an address. We've tried shifting the DHCP server to the AP the phones connect to, still no good, no output from DHCP debugs to show the phones are even requesting an address. Any suggestions anyone?

[migilles]

Sure encyrption is set correctly? Maybe can attached your ap config.

[rgannon]

I have the same problem. Two identically configured 7920s. Both authenticate but only one will get an IP address.

There is no evidence in the DHCP server that the phone ever requested an address.

If I give the phone an address manually it still does not register with Callmanager.

I'll let you know if I figure it out.

[migilles]

Sounds like incorrect WEP key on one of the phones. Would suggest using the Config Utility to avoid entering a 26 digit key by hand. To verify that, capture wireless sniffer then try to decrypt the packets w/ the wep key you are using. If the other phone shows as WEP data, then phone is configured with the wrong key.

[andrew.brazier]

Sounds like my problem : ) I'm on site tomorrow and intend to strip all the security from the voice SSID on the AP, config the phones to match and see if that helps. I'll post and results here. Phones are f/w 2.1.1 (so they tell me).

It's odd because the phones authenticate which is the last step before DHCP lease so the security setup must be OK?

[migilles]

We had a 2.01 release, but not 2.1.1. Would encourage to use 3.01 that released a few months ago.

If using static WEP, the phone can still associate regardless of correct key as long as some key is specified.

[andrew.brazier]

Back from site, still not working! Phones configured OK as far as I can tell as is the AP. tried stripping all the security from the voice SSID on the AP and the phone, still no DHCP! I tried setting up a DHCP server on the AP to eliminate any network issues, still nothing. DHCP debugs on the AP showed NOTHING, no requests from the phones at all. I tried using a Cisco a/b/g card in my laptop connecting to the voice SSID, got an association & authentication, no DHCP! I then configured a DHCP server on my laptop and was eventually able to lease an address using the Cisco card.....but couldn't get an address with the phones.

I relocated the DHCP server back onto the router and tried using Ethereal to check for DHCP packets from the phones; not a thing.

I know the phones work as they've been tested at another site, the only thing I've noted is that the IOS on the AP's is slightly newer than that at the "working" site. I've just flashed the IOS back down and will test again on Monday.

Any suggestions gratefully accepted! : )

PS: Authentication is LEAP back to an ACS server at a central site, the ACS says authentication from the phones is A-OK.

[migilles]

Laptop not working either? Must be some config issue. Would advise to open a TAC case to pursue further and inspect your configs.

[rgannon]

My 7920 is now working. The problem was, as someone suggested, the WEP keys. The phone would authenticate and associate but the AP would not pass any of it's traffic. By re-etering the correct keys, the phone now gets a DHCP address and communicates fine.

[andrew.brazier]

Problem solved! It was a config problem...but not with the phones or the AP's (and it was someone else's config I might add!)

The switch that all the AP's were connected to did not have the voice VLAN defined on it. It was set as a vtp server but only the data vlan was defined. No IP desktop phones were connected to this switch, just the AP's for the wireless phones. Once we defined the VLAN on the switch the phones immediately grabbed an IP address, registered with call manager, etc.

[migilles]

Ouch! Would suggest setting up a master VTP server and the other switches as clients to ensure no VLANs are left off a switch when a new VLAN is added. Glad to see it was a config issue and not a phone issue.

[andrew.brazier]

That's exactly what I'd normally do, the whole setup was someone else's though. I've suggested that's what they should do, whether they will or not..... : (