9130AXI EWC Clients Get DHCP Address But Can't Reach Internet

[rommonster]

Labbing with a 9130AXI-B EWC and I am unsure what is causing the issue I am seeing. Running 17.12.4.

Wireless Clients ---- EWC-AP "employee" PSK SSID --- C3850 --- Firepower ASA --- Internet

Wired Clients ---- C3850 --- Firepower ASA --- Internet

All VLAN interfaces/gateways on the 3850. Default route on 3850 to Firepower ASA for internet access

• EWC web gui and SSH is reachable from anywhere on the network (including inter-vlan traffic reaching the native management IP and web gui of the EWC)
• EWC-AP gets DHCP address from scope defined on server in different VLAN, reachable inter-vlan.
• Wireless clients connect to SSID and get DHCP address from scope defined on server in different vlan
• Wired clients can ping/web to management IPs and web gui of EWC in management VLAN, but can't reach clients associated to SSID
• Wireless client can reach other wireless clients, but are unable to reach anything not connected to the SSID (can't reach wired clients, can't reach internet, can't reach default gateway, can't reach management IP of EWC, can't ping DHCP servers they RECEIVED A DHCP ADDRESS FROM)
• Cisco wireless debug tool (https://cway.cisco.com/wireless-debug-analyzer/) shows no issues with clients, association works fine, they receive DHCP address from a server outside the wireless subnet, and reach run state. However they are then unable to communicate to anything outside the same subnet off the EWC (includes the DHCP server it got the address from, also can't ping the gateway for the VLAN).
• Wired client in an access port on the wireless vlan is able to communicate to the internet and inter-vlan without issue.

On Firepower ASA, no traffic is seen from wireless clients associated to the SSID attempting to reach the internet, so traffic is never making it to the 3850 switch and being routed to the Firepower. So the EWC seems to somehow be limiting clients from reaching outside the SSID/subnet.

If I replace the 9130AXI with a 9115AXI we had previously or a 3802i running Mobility Express, they work without issue in similar setup (trunking multiple vlans with native vlan for management).

i do have a site and flex policy configured with the VLANs I am trunking including the native VLAN and it is applied to the EWC AP.

What am I missing here? Is something with 9130AX different? Or am I missing a configuration step somewhere I am not seeing? Pulling my hair out, any help would be greatly appreciated.

[Flavio Miranda]

@rommonster 

 Sounds like Bug. There are few bugs that could cause this issue in 17.12.4 and privious version. I would try to change the version. 

It does make sense does not work with 9130 if work with 9115. 

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-12/release-notes/rn-17-12-9800.html#open-caveats-for-cisco-ios-xe-dublin-17.12.4

[rommonster]

Yes, this must be the case.

Unfortunately I don't have access to the ESW13 release of 17.12.4 that Rich mentioned below (for some reason it requires a contract, whereas the regular EWC images do not). So instead I downgraded to 17.9.6 (the other recommended release I can download). As soon as the 9130 came online it was at least routing traffic, just not for the right VLANs.

Thanks!

[Rich R]

Although you might be using the same EWC config on the 9115 and 9130 have you checked that you have the same tags applied to the AP in both cases? How are you applying the tags?
show ap tag summ
show ap name <ap-name> tag detail

Have you checked the EWC config using the Config Analyzer (link below)?

Also make sure you're using the latest ESW13 release of 17.12.4 as per the TAC Recommended link below:
https://software.cisco.com/download/specialrelease/b5170408cc94b5cb4ffce878e044cf6e

[rommonster]

Hi Rich,

So after downgrading to 17.9.6 (I'm unable to download the ESW for 17.12.4 currently) I am getting some connectivity on clients but not the way I intended...

I have 3 VLANs that I'm trunking to the 9130 EWC: 2, 3, and 10. Native VLAN is 2.

2 is for the EWC/AP management to use (native vlan)
3 is for DMZ/Guest Network
10 is for internal traffic (where LAN clients should sit)

I have two SSIDs configured. One for Guest (VLAN 3) and one for "Employee" (internal LAN access, VLAN 10).

Currently all clients, regardless of which SSID they connect to, get an IP in VLAN 2.

I am unsure how this is happening as I double checked and it appears as if all of my tags are applied correctly.

I thought that the Flex profile vlan tab defines the VLANs in use and that allows for multiple SSIDs in different VLANs on EWC since the VLAN and VLAN Group tabs don't exist in Layer 2 menu on EWC? The VLANs defined in the Flex config are properly configured in the Policy-Profiles for each SSID.

Maybe you were right and I somehow have tags applied (or configured) incorrectly? Do you have any idea where there may be an error?

When I use the config checker I don't see any major errors, nothing related to VLANs or Flex.

[Rich R]

Hard to say without seeing your entire config and "show ap tag summ".

Defining VLANs in flex profile is not essential unless you want to use VLAN names.  You can use VLAN ID (number) in the WLAN profile without any flex definition of the VLAN and it will just work.

Have you checked your switch port config?

[Scott Fella]

I would try to validate the vlans on the switch.  An example would be to create an access vlan 3 and an access vlan 10 on the switch the ap is connected to.  Then connect your laptop to each port and validate if you get the right dhcp address.  If not, then you might not be spanning the vlans, thus getting dropped in the native vlan.