C9501axi AP getting IP from wrong vlan

[ccollins11111]

I am seeking a little assistance in setting up flex connect aps on our new c9800-l controllers. I have set everything up based on cisco's documentation, and the issue I am running into is when the client connects to the AP they are getting an IP address on the wrong vlan. I have tried everything that I can think of with no luck. The clients are pulling an IP from vlan41 and they should be pulling an ip from vlan 11.

Cisco Switch config:

AP Port-

interface GigabitEthernet x/x/x

description TIP_Net_Eng Test Access Point

switchport trunk native vlan 41

switchport trunk allowed vlan 11,41

switchport mode trunk spanning-tree portfast trunk

WLC Port -

interface GigabitEthernet x/x/x

description tip-wlc1_0/0

switchport trunk native vlan 41

switchport trunk allowed vlan 11,41,90

switchport mode trunk

channel-group 7 mode active

spanning-tree portfast 

Any help on this would be greatly appreciated, or even pointed in the direction for good documentation on this setup that would include the switch port configs as well.

Thank you,

[Karsten Iwen]

• From which VLAN should the client get the IP?
• From which VLAN does the client get the IP?
• central or local switching (FlexConnect)?
• How is it configured?

[ccollins11111]

• From which VLAN should the client get the IP? 11
• From which VLAN does the client get the IP? 41
• central or local switching (FlexConnect)? Flexconnect
• How is it configured? Which configuration are you looking for?

[Karsten Iwen]

How do you assign the VLAN11? Is VLAN 11 added to the AP in the Flex-Profile?

[ccollins11111]

wireless profile flex site-flex1
description "site Flex Profile"
ip http client proxy 0.0.0.0 0
no local-auth ap radius
native-vlan-id 41
vlan-name WiFi
vlan-id 11

wireless profile policy Site
no central association
no central dhcp
no central switching
description Internal
ipv4 dhcp required
ipv4 dhcp server x.x.x.x
vlan 11

[Karsten Iwen]

That looks ok ...

Can you post the output of

ewc#show wireless tag site all

and

ewc#show wireless tag policy all

[JPavonM]

The profile config does not looks good, try this:

wireless profile flex site-flex1
 description "site Flex Profile"
 ip http client proxy 0.0.0.0 0
 no local-auth ap radius
 native-vlan-id 41
 vlan-name WiFi
  vlan-id 11

wireless profile policy Site
 no central association
 no central dhcp
 no central switching
 description Internal
 ipv4 dhcp required
 ipv4 dhcp server x.x.x.x
 vlan WiFi

[ccollins11111]

Tried this a few moments ago, now I am getting a 169.254 address, may not be able to reach the DHCP server from that vlan. I will check that next.

[Karsten Iwen]

If you have an ip helper on the L3 SVI, you can remove the DHCP-server from your profile.

[Karsten Iwen]

---

@JPavonM wrote:

The profile config does not looks good, try this:

wireless profile policy Site
 vlan WiFi

---

The Vlan is allowed to be set as the ID.

[ccollins11111]

site-wlc1#show wireless tag site all

Site Tag Name : Site
Description : Site Tag
----------------------------------------
Flex Profile : Site-flex1
AP Profile : Site_AP
Local-site : No
Image Download Profile: default
Fabric AP DHCP Broadcast : Disabled
Fabric Multicast Group IPv4 Address : 232.255.255.1

Site Tag Name : default-site-tag
Description : default site tag
----------------------------------------
AP Profile : default-ap-profile
Local-site : Yes
Fabric Control-Plane : default-control-plane
Image Download Profile: default
Fabric AP DHCP Broadcast : Disabled
Fabric Multicast Group IPv4 Address : 232.255.255.1

site-wlc1#show wireless tag policy all

Policy Tag Name : Site_PolicyTag
Description : For Site

Number of WLAN-POLICY maps: 1
WLAN Profile Name Policy Name
------------------------------------------------------------------------
SSID Site

Policy Tag Name : default-policy-tag
Description : default policy-tag

Number of WLAN-POLICY maps: 0

[ccollins11111 · Accepted solution]

I found that my firewall policy was not set up correctly to allow that network to the DHCP servers. I have corrected this and it seems to be working. I appreciate you all looking into this.