C9800 Internal DHCP server for local switching SSID

[ngkin2010]

Hi Community,

I am planning to enable Internal DHCP for one of the SSID on C9800 WLC, but I am not sure if it's technically valid or not.

Here is some background: 

The SSID or the WLAN profile is configured as central authentication, local switching, local association, with WPA2 (PSK), just like FlexConnect in AireOS.

Given the SSID is assigned for VLAN20, and the diagram will be like:

I have a few doubts about the design:

1. Is the SVI (VLAN20) on C9800 is necessary for the internal DHCP server to work? 

2. If the SVI is necessary on C9800, and when I creating VLAN20 SVI on C9800, the interface oper status is down (e.g. no trunk allowed vlan 20 on C9800), is it necessary to make it up?  

3. If the SVI need to be UP/UP, then I am not quite sure the flow of DHCP discover; and here is my understanding:

• a)  Client associated to the SSID and assigned to VLAN20
• b)  Client broadcast the DHCP Discover, and Core Switch will receive the broadcast.
• c)  Core Switch's SVI VLAN20 with [ ip helper 10.1.1.1 ]  will forward the DHCP discover to C9800 (10.1.1.1) with the source IP 192.168.0.1
• d)  After C9800 receiving the DHCP Discover, it will allocate IP and send out DHCP Offer back to core switch 192.168.0.1
• e)   The DHCP offer should never reach the 192.168.0.1 because according to C9800's routing table, 192.168.0.0/24 is directly connected subnet, but 192.168.0.1 is not on the cloud with C9800 (e.g. not on the same broadcast domain).
• f)    The client will never get the IP address from Internal DHCP.

[marce1000]

 - Lot's of specifics , always useful when working on 9800-configurations and also currently is (CLI) : show tech wireless , have the  output processed by : https://cway.cisco.com/tools/WirelessAnalyzer/   , you will already get a lot of useful advisories.

 M.

[Arshad Safrulla]

The best practice is to use an external DHCP server, having said that you must create a SVI on VLAN20 if the WLC being used as the DHCP server and it will work. From the DHCP prospective the wireless client will be considered as a wired client (due to flex connect local switching) when the DHCP request reaches the WLC. 

Since you need to allow this in the trunk uplink connecting to the upstream switch SVI will be up/up, so make sure you add VLAN20 to allowed VLAN's. 

I am sharing the guide for starred IOS-XE code at the moment, however it's recommended that you read the documentation related to the code you have in your WLC before implementing.

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE Amsterdam 17.3.x - DHCP for WLANs [Cisco Catalyst 9800 Series Wireless Controllers] - Cisco

[ngkin2010]

Hi Arshad,

Thanks for your reply.

The main point in the proposed setup is C9800 is located in different site, and its VLAN20 is not spanning to remote site (where the AP located). 

For example, the VLAN20 at Site 1 where the C9800 located is not the same as VLAN20 at Site 2 where the AP located.

So, I am curious:

3. If the SVI need to be UP/UP, then I am not quite sure the flow of DHCP discover; and here is my understanding:

• a)  Client associated to the SSID and assigned to VLAN20
• b)  Client broadcast the DHCP Discover, and Core Switch will receive the broadcast.
• c)  Core Switch's SVI VLAN20 with [ ip helper 10.1.1.1 ]  will forward the DHCP discover to C9800 (10.1.1.1) with the source IP 192.168.0.1
• d)  After C9800 receiving the DHCP Discover, it will allocate IP and send out DHCP Offer back to core switch 192.168.0.1
• e)   The DHCP offer should never reach the 192.168.0.1 because according to C9800's routing table, 192.168.0.0/24 is directly connected subnet, but 192.168.0.1 is not on the cloud with C9800 (e.g. not on the same broadcast domain).
• f)    The client will never get the IP address from Internal DHCP.

[Arshad Safrulla · Accepted solution]

Ok, in this case you need to use central dhcp. You can enable it under the policy profile, you also need to make sure that the DHCP server IP is configured under the policy profile and also ipv4 dhcp required is selected. Also you need to have Flex NAT PAT enabled.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/flexconnect.html#:~:text=Wireless%20Controllers%20document.-,NAT%2DPAT%20for%20FlexConnect,-If%20you%20want

I have tested the same with an external DHCP server in my HQ, but I haven't tested it with an Internal DHCP server. But I believe this should help you to achieve your requirement.

[ngkin2010]

Hi Arshad, 

Thanks for your comment, and I will try it out with Central DHCP & Flex NAT PAT enabled.

Thanks~

[Flavio Miranda · Accepted solution]

Hi

 "I am planning to enable Internal DHCP for one of the SSID on C9800 WLC, but I am not sure if it's technically valid or not."

It is valid so much that it support internal DHCP.  However, for heavy environment, it is best practive to have a dedicate DHCP server.  But, for low demand, no problem at all.  We see switches and routers over there doing DHCP just fine.

. Is the SVI (VLAN20) on C9800 is necessary for the internal DHCP server to work? 

Yes.

2. If the SVI is necessary on C9800, and when I creating VLAN20 SVI on C9800, the interface oper status is down (e.g. no trunk allowed vlan 20 on C9800), is it necessary to make it up?  

  Did you create the VLAN on the WLC?  Interface vlan is different from vlan. Priviouly, when we issue the command interface vlan the IOS already created the vlan for us, not anymore. You need to create the vlan.

3. If the SVI need to be UP/UP, then I am not quite sure the flow of DHCP discover; and here is my understanding:

• a)  Client associated to the SSID and assigned to VLAN20

Yes.

• b)  Client broadcast the DHCP Discover, and Core Switch will receive the broadcast.

Nop. It will be manage internaly on the WLC.

• c)  Core Switch's SVI VLAN20 with [ ip helper 10.1.1.1 ]  will forward the DHCP discover to C9800 (10.1.1.1) with the source IP 192.168.0.1

Nop. It will be manage internaly on the WLC.

• d)  After C9800 receiving the DHCP Discover, it will allocate IP and send out DHCP Offer back to core switch 192.168.0.1

Nop. It will be manage internaly on the WLC.

• e)   The DHCP offer should never reach the 192.168.0.1 because according to C9800's routing table, 192.168.0.0/24 is directly connected subnet, but 192.168.0.1 is not on the cloud with C9800 (e.g. not on the same broadcast domain).

Nop. It will be manage internaly on the WLC.

• f)    The client will never get the IP address from Internal DHCP.

Yes, will do.   When configuring the internal DHCP, disable the option "Reserved Only".

Please, look this guide:

https://wifininjas.net/2019/08/06/wn-blog-007-c9800-wlc-internal-dhcp-server-config/ 

[ngkin2010]

Hi Flavio,

Thanks for your detailed explanation. I do agree that it's not a very good option and not following best practice.

I've to validate if the design is technically possible when external DHCP server is not an option.   

It become make more sense, if WLC will mange the DHCP discovery process internally. thanks~

[Rich R]

Since the VLAN is locally switched why would you use the WLC for DHCP?

That also means that users won't be able to get an IP address if you lose your WLC connection.

Simply configure DHCP locally at the site (instead of helper) and save yourself a whole lot of complication on the WLC.

[ngkin2010]

Hi rrudling,

That's true, I agree that it's not a good design if external DHCP server is available.