AP getting DHCP offer from another AP

[bcomanescu157]

I  have around 40AP´s in one site and they are randomly dropping off the network, obtaining an IP in the wrong subnet.

The first time I saw this is 6 months ago, and it only happens for one site.

The problem summary is : 

Management Vlan 100 Subnet 10.98.64.0/24
1. AP 1 – regular lease expires in subnet 10.98.64.0/24 – DHCP Discover sent on Vlan 100

1. AP 2 – sends an offer back on Vlan 100/offer contains client IP in 192.168.1.0/24 subnet/sourced with IP 192.168.1.1
2. DHCP Server (reached via dhcp relay on router in Vlan 100) – sends a correct offer in subnet 10.98.64.0/24
3. AP 1 – depending on which offer is faster reaching the AP, the IP will be preferred/request sent.

Subnet 192.168.1.0/24 is not configured anywhere on the network.

I know it comes from another AP after looking for the MAC address.

Also, it is not only one AP that sends the DHCP offer for subnet 192.168.1.0/24, it is more of them but all of them under the 192.168.1.1 address.

Has anyone stumbled upon this issue before? 

Might enabling DHCP snooping be able to solve the issue? Even so, i still want to find the root cause in order to avoid this happening to other sites in the future

[marce1000]

- If these dhcp offers are coming from rogue ap's  then you will definitely need DHCP snooping , Wireshark and or traffic capture can reveal the mac address from the malicious dhcp server (service).

 M.

[bcomanescu157]

They're APs in the same topology, linked to the same WLC.

What should I look for in the AP config or WLC in order to stop the other APs from sending DHCP messages?

[marce1000]

  >...What should I look for in the AP config or WLC in order to stop the other APs from sending DHCP messages?

 - That never happens when these are capwap access points and joined to the controller (check). You are getting confused with some other phenomenon happening on the network.

 M.

[JPavonM]

Definitely something attached to the network as DHCP server.

Look for ISP router (which seems to be the case on a remote branch), LTE gateway, hotspot, or maybe a casting device,...

[nordovv]

yes, it should be DHCP unequivocally

[Rich R]

If the DHCP offers are really coming from the APs and not something spoofing the AP MAC address (check the switch MAC address tables) then you might have APs running Mobility Express software with local DHCP server configured? (That's not default so somebody would have had to configure them that way - usually only used for site survey AP on a stick)
What model of AP are they (full model number) and what software are they running (show ver)?

If that is the case then convert them to standard CAPWAP APs:
See the section Converting an AP from Mobility Express to CAPWAP Type in https://www.cisco.com/c/en/us/td/docs/wireless/access_point/mob_exp/82/user_guide/b_ME_User_Guide_82/appendix.html
Take note that you have to login to the ME AP and then login to the AP using apciscoshell and then change the ap-type (many people make the mistake of trying to change the ap-type from the ME CLI where the command is not recognised).

ps. you could probably work this out remotely by using "show cdp neigh detail" on your switch to see what software the APs are running.