All clients stuck in DHCP_REQD

[krock]

HI all,

I have a 5508 WLC controller running 8.3.143.0 software version. This is a new setup I put up so I can steer away from testing in production. I have this controller connected to two Nexus 9k's in a vPC. Every client that trys to connect to my test WLAN gets stuck in DHCP_REQD. I am getting my DHCP from a remote computer and have tested dhcp using wired connection directly from the switch and that works. I have disabled all DHCP options on the controller as well. I get a link local ipv6 address but not ipv4. 

I have attached a debug of me trying to connect my phone to the WLAN. I also tried this on a wide open WLAN with the same result. There is no firewall in-between or any other security device that might block dhcp requests. 

Thank you 

[Leo Laohoo]

---

@krock wrote:

*DHCP Socket Task: Mar 01 14:42:04.417: b8:63:4d:1b:9f:05 DHCP Opt82 bridge mode insertion enabled, inserts opt82 if opt82 is enabled vlan=960, datalen =18, optlen=64

• Check VLAN 960 and see if this is trunked from the WLC to the switch or not.  
• See if VLAN 960 has an IP helper address on the WLC.
• Under the SSID, is "DHCP Addr Assignment" ticked or not?

[krock]

It's trunked from WLC to N9k

(Cisco Controller) >show interface summary

Number of Interfaces.......................... 7

Interface Name Port Vlan Id IP Address Type Ap Mgr Guest
-------------------------------- ---- -------- --------------- ------- ------ -----
management LAG 920 172.28.20.4 Static Yes No
redundancy-management LAG 920 0.0.0.0 Static No No
redundancy-port - untagged 0.0.0.0 Static No No
service-port N/A N/A 2.2.2.2 Static No No
sn-int LAG 959 172.28.20.36 Dynamic No No
sn-int1 LAG 960 172.28.20.68 Dynamic No No
virtual N/A N/A 1.1.1.1 Static No No

(Cisco Controller) >

VLAN 960 has a helper address. I was able to put a PC in a port on that vlan and I was able to get a DHCP address. 

Under the SSID the "DHCP Addr Assignment" is checked.. 

[superego]

Can you show output for this command "show interface detailed sn-int1"?

Make sure the DHCP servers are assigned in the ff  fields below:

Primary DHCP Server

Secondary DHCP Server

If not, go to GUI, Controller > Interfaces > sn-int1 >

Primary DHCP Server

Secondary DHCP Server

Then uncheck the checkboxes below with DHCP Proxy Mode "Global"

[krock]

Those parameters were already in place. Here is the output. There is no secondary DHCP server since I don't have two in this environment. 

(Cisco Controller) >show interface detailed sn-int1

Interface Name................................... sn-int1
MAC Address...................................... e0:5f:09:46:88:0f
IP Address....................................... 172.28.20.68
IP Netmask....................................... 255.255.255.224
IP Gateway....................................... 172.28.20.65
External NAT IP State............................ Disabled
External NAT IP Address.......................... 0.0.0.0
Link Local IPv6 Address.......................... fe80::e25f:b9ff:fe46:780f/64
STATE ........................................... NONE
IPv6 Address..................................... ::/128
STATE ........................................... NONE
IPv6 Gateway..................................... ::
IPv6 Gateway Mac Address......................... 00:00:00:00:00:00
STATE ........................................... NONE
VLAN............................................. 960
Quarantine-vlan.................................. 0
NAS-Identifier................................... none
Active Physical Port............................. LAG (13)
Primary Physical Port............................ LAG (13)
Backup Physical Port............................. Unconfigured
DHCP Proxy Mode.................................. Global

Primary DHCP Server.............................. 192.168.30.65
Secondary DHCP Server............................ Unconfigured
DHCP Option 82................................... Disabled
DHCP Option 82 bridge mode insertion............. Disabled
IPv4 ACL......................................... Unconfigured
URL ACL.......................................... Unconfigured
URL ACL.......................................... Unconfigured
mDNS Profile Name................................ Unconfigured
AP Manager....................................... No
Guest Interface.................................. No
3G VLAN.......................................... Disabled
L2 Multicast..................................... Enabled

(Cisco Controller) >

[superego]

Ping DHCP from the WLC client interface using CLI:

ping 192.168.30.65 sn-int1

[krock]

I have no problems pinging from WLC to the DHCP Server 

(Cisco Controller) >ping 192.168.30.65 sn-int1

Send count=3, Receive count=3 from 192.168.30.65

(Cisco Controller) >

[superego]

Do "show wlan summary"

Use the WLAN id number of the SSID you're using for the command below.

Provide output:

show wlan <WLAN id>

[krock]

(Cisco Controller) >show wlan summary

Number of WLANs.................................. 1

WLAN ID WLAN Profile Name / SSID Status Interface Name PMIPv6 Mobility
------- ------------------------------------- -------- -------------------- ---------------
1 LAB Internal / SN-POC-I Enabled sn-int1 none

[superego]

Provide output:

show wlan 1

[krock]

here you goo

(Cisco Controller) >show wlan 1

WLAN Identifier.................................. 1
Profile Name..................................... Internal
Network Name (SSID).............................. SN-POC-I
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Enabled
Network Admission Control
Client Profiling Status
Radius Profiling ............................ Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Local Profiling ............................. Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Radius-NAC State............................... Enabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum Clients Allowed.......................... Unlimited
Maximum number of Clients per AP Radio........... 200
ATF Policy....................................... 0
Number of Active Clients......................... 0
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 28800 seconds
User Idle Timeout................................ 3600 seconds
Sleep Client..................................... disable
Sleep Client Timeout............................. 720 minutes
User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... none
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ sn-int1
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
WLAN Layer2 ACL.................................. unconfigured
WLAN URL ACL..................................... unconfigured
mDNS Status...................................... Enabled
mDNS Profile Name................................ default-mdns-profile
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
Tunnel Profile................................... Unconfigured
PMIPv6 Mobility Type............................. none
PMIPv6 MAG Profile........................... Unconfigured
PMIPv6 Default Realm......................... Unconfigured
PMIPv6 NAI Type.............................. Hexadecimal
PMIPv6 MAG location.......................... WLC
Quality of Service............................... Silver
Per-SSID Rate Limits............................. Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Per-Client Rate Limits........................... Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... 802.1P (Tag=0)
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
Authentication................................ 192.168.1.1 1812 *
Accounting.................................... 192.168.1.1 1813 *
Interim Update............................. Enabled
Interim Update Interval.................... 0
Framed IPv6 Acct AVP ...................... Prefix
Dynamic Interface............................. Disabled
Dynamic Interface Priority.................... wlan
Local EAP Authentication......................... Disabled
Radius NAI-Realm................................. Disabled
Mu-Mimo.......................................... Enabled
Security

802.11 Authentication:........................ Open System
FT Support.................................... Adaptive
Static WEP Keys............................... Disabled
802.1X........................................ Disabled
Wi-Fi Protected Access (WPA/WPA2)............. Enabled
WPA (SSN IE)............................... Disabled
WPA2 (RSN IE).............................. Enabled
TKIP Cipher............................. Disabled
AES Cipher.............................. Enabled
CCMP256 Cipher.......................... Disabled
GCMP128 Cipher.......................... Disabled
GCMP256 Cipher.......................... Disabled
OSEN IE.................................... Disabled
Auth Key Management
802.1x.................................. Enabled
PSK..................................... Disabled
CCKM.................................... Disabled
FT-1X(802.11r).......................... Disabled
FT-PSK(802.11r)......................... Disabled
PMF-1X(802.11w)......................... Disabled
PMF-PSK(802.11w)........................ Disabled
OSEN-1X................................. Disabled
SUITEB-1X............................... Disabled
SUITEB192-1X............................ Disabled
FT Reassociation Timeout................... 20

FT Over-The-DS mode........................ Enabled
GTK Randomization.......................... Disabled
SKC Cache Support.......................... Disabled
CCKM TSF Tolerance......................... 1000
Wi-Fi Direct policy configured................ Disabled
EAP-Passthrough............................... Disabled
CKIP ......................................... Disabled
Web Based Authentication...................... Disabled
Web Authentication Timeout.................... 300
Web-Passthrough............................... Disabled
Mac-auth-server............................... 0.0.0.0
Web-portal-server............................. 0.0.0.0
Conditional Web Redirect...................... Disabled
Splash-Page Web Redirect...................... Disabled
Auto Anchor................................... Disabled
FlexConnect Local Switching................... Disabled
FlexConnect Central Association............... Disabled
flexconnect Central Dhcp Flag................. Disabled
flexconnect nat-pat Flag...................... Disabled
flexconnect Dns Override Flag................. Disabled
flexconnect PPPoE pass-through................ Disabled
flexconnect local-switching IP-source-guar.... Disabled
FlexConnect Vlan based Central Switching ..... Disabled
FlexConnect Local Authentication.............. Disabled
FlexConnect Learn IP Address.................. Enabled
Client MFP.................................... Optional
PMF........................................... Disabled
PMF Association Comeback Time................. 1
PMF SA Query RetryTimeout..................... 200
Tkip MIC Countermeasure Hold-down Timer....... 60
Eap-params.................................... Disabled
AVC Visibilty.................................... Disabled
AVC Profile Name................................. None
Flow Monitor Name................................ None
Split Tunnel Configuration
Split Tunnel................................. Disabled
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Enabled
802.11k Neighbor List Dual Band.................. Disabled
802.11v Directed Multicast Service............... Disabled
802.11v BSS Max Idle Service..................... Enabled
802.11v BSS Transition Service................... Enabled
802.11v BSS Transition Disassoc Imminent......... Disabled
802.11v BSS Transition Disassoc Timer............ 200
802.11v BSS Transition OpRoam Disassoc Timer..... 40
DMS DB is empty
Band Select...................................... Enabled
Load Balancing................................... Disabled
Multicast Buffer................................. Disabled
Universal Ap Admin............................... Disabled
Broadcast Tagging................................ Disabled

Mobility Anchor List
WLAN ID IP Address Status Priority
------- --------------- ------ --------

802.11u........................................ Disabled

MSAP Services.................................. Disabled

Local Policy
----------------
Priority Policy Name
-------- ---------------

Lync State ...................................... Disabled
Audio QoS Policy................................. Silver
Video QoS Policy................................. Silver
App-Share QoS Policy............................. Silver
File Transfer QoS Policy......................... Silver
QoS Fastlane Status.............................. Disable
Selective Reanchoring Status..................... Disable

[superego]

1. Configure a new Test WLAN, i.e. "TESTWLAN" to use PSK and use the same interface "sn-int1". This is to isolate AAA override. If this works then check your AAA settings e.g. in ISE/RADIUS.

2. If still not able to get IP, in the interface sn-int1 "DHCP Proxy Mode- change to Disable". If this works then try testing again on the "LAB Internal" SSID.

3. If still not able to get IP, check nexus switch if dhcp snooping is enabled.

In your debug output provided, it shows the Authentication completed then DHCP request was received but not did not send to a DHCP server. Stuck on a first stage of DHCP process.

Log your session when you run the debug:

debug client x.x.x.x (MAC address)
debug dhcp message enable
debug dhcp packet enable

[superego]

Can you also provide a diagram on how the WLC is connected to Nexus.

Just want to check that WLC is LAG to one Nexus switch.

https://community.cisco.com/t5/wireless-and-mobility/connecting-5520s-wlc-to-nexus-7706s/td-p/2875712?attachment-id=108602

[krock]

I already tried that but did it again to provide the debug 

1. Configure a new Test WLAN, i.e. "TESTWLAN" to use PSK and use the same interface "sn-int1". This is to isolate AAA override. If this works then check your AAA settings e.g. in ISE/RADIUS.   = NO IP 

2. If still not able to get IP, in the interface sn-int1 "DHCP Proxy Mode- change to Disable". If this works then try testing again on the "LAB Internal" SSID.  = NO IP 

3. If still not able to get IP, check nexus switch if dhcp snooping is enabled.    =    I am unable to see any dhcp snooping commands or outputs for the version of the switch that I am on. 

n9k1# sh ip dhcp relay
DHCP relay service is enabled
Insertion of option 82 is disabled
Insertion of VPN suboptions is disabled
Insertion of cisco suboptions is disabled
Global smart-relay is disabled

Smart-relay is enabled on the following interfaces:
------------------------------------------------------

Subnet-broadcast is enabled on the following interfaces:
------------------------------------------------------

Helper addresses are configured on the following interfaces:
Interface Relay Address VRF Name
------------- ------------- --------

Helper addresses are configured on the following interfaces:
Interface Relay Address VRF Name
------------- ------------- --------
Vlan960 192.168.30.65

Please see attached for the debug commands you asked for 

[krock]

here is a quick and dirty diagram