auth no associated yes

[Network Pro]

Hi,

i have a few AP in flexconnect (H-Reap) mode. i am using a common ssid for centrally switched which works fine on other offices deployed with h-reap AP;s but for 1 office that users connect.

if i look at the clients page i see the status is Associated  and Auth sayss NO...I can see users authenticating on the ACS Server...i cant see a DHCP address whereas other offices seems to be fine getting dhcp address. the association is YES and Auth is also YES.

DHCP is local running on win server

i get deauthenticated error messages on wlc with reason code 1

any thoughts ?

[David Watkins]

So from the description, it seems the WLAN the clients are hitting on this problematic AP is "centrally switched"?  Please confirm.  Is this AP in question using the same interface as your other Flex APs, or do you have an AP group changing the interface used?  Can you post a client debug for a client trying to connect on the AP in question?

>debug client

[Network Pro]

they all have the same interface and the wired thing is it happens only on locally switched (h-reap) network and not on centrally switched ssid

[David Watkins]

OK so the issue is with locally switched SSIDs.  Do you have the AP properly configured with VLAN support and tagging of your locally switched WLANs to the appropriate VLANs for the respective location?  Also, verify the port config the AP is attached to is allowing the respective VLANs to traverse.

Can you post the AP config info so we can see your VLAN status and tagging?

>show ap config general

Also, please  post the switchport config for where the AP is joined

>show run int

[Network Pro]

hi,

attached file

[David Watkins]

The switchport shows you have VLANS 113 and 114 (and 1 intrinsically).

switchport trunk native vlan 113

switchport trunk allowed vlan 113,114

switchport mode trunk

Your AP has VLAN support enabled with a native VLAN ID of 113, which means the APs management address is in VLAN113, however given your configuration clients connecting to WLAN11 are going to be placed on vlan 1 (tagged in this case due to native config).

H-REAP Vlan mode :............................... Enabled

        Native ID :..................................... 113

        WLAN 11 :....................................... 1

Does your client need to end up on vlan 114?  If so, you need to click on the AP in question, select the FlexConnect tag and choose VLAN Mappings. From there, make sure you specify your VLAN ID for this locally switched WLAN.

Right now if a client connects to this AP they are being placed on VLAN 1.

[Network Pro]

Hi David,

Thanks for this. I agree the ap management is vlan 113. I have gone to teh AP-> HREAP and changed the vlan mapping to vlan 113. so wlan 11 is mapped to vlan 113 on every AP.

The problem i have having is the clients dont get an ip even though authentication and dhcp server are fine. what do you think is the problem ?