Hm, seem´s to be the right config. I´m sorry i had not enough time to search for your bug, but here is my config of the aironet. This config works fine with two external dhcp servers on each vlan.
version 12.3
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname XXXX
!
enable secret XXXXXXX
!
username XXXXX privilege 15 password 7 XXXXXXX
ip subnet-zero
!
!
aaa new-model
!
!
aaa group server radius rad_eap
server 10.xxxx auth-port 1812 acct-port 1813
!
aaa group server radius rad_mac
!
aaa group server radius rad_acct
server 10.xxxx auth-port 1812 acct-port 1813
!
aaa group server radius rad_admin
server 10.xxxx auth-port 1812 acct-port 1813
!
aaa group server tacacs+ tac_admin
server 10.xxxxx
!
aaa group server radius rad_pmip
!
aaa group server radius dummy
!
aaa group server tacacs+ tac_acct
server 10.xxxxx
!
aaa authentication login default group tac_admin local
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authentication enable default enable
aaa accounting exec default start-stop group tac_acct
aaa accounting commands 15 default start-stop group tac_acct
aaa accounting network default start-stop group rad_acct
aaa accounting connection default start-stop group tac_acct
aaa accounting system default start-stop group tac_acct
aaa session-id common
dot11 vlan-name GuestVlan vlan 2
!
dot11 ssid 802.1x
vlan 1
authentication open eap eap_methods
authentication network-eap eap_methods
accounting acct_methods
!
dot11 ssid GuestVlan
vlan 2
authentication open
accounting acct_methods
guest-mode
!
!
!
!
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
encryption mode wep mandatory
!
encryption vlan 1 mode wep mandatory
!
ssid 802.1x
!
ssid GuestVlan
!
short-slot-time
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0
54.0
power local cck 1
power local ofdm 1
channel 2462
station-role root
no cdp enable
!
interface Dot11Radio0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface Dot11Radio0.2
encapsulation dot1Q 2
no ip route-cache
bridge-group 2
bridge-group 2 subscriber-loop-control
bridge-group 2 block-unknown-source
no bridge-group 2 source-learning
no bridge-group 2 unicast-flooding
bridge-group 2 spanning-disabled
!
interface FastEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
!
interface FastEthernet0.1
encapsulation dot1Q 1 native
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
!
interface FastEthernet0.2
encapsulation dot1Q 2
no ip route-cache
bridge-group 2
no bridge-group 2 source-learning
bridge-group 2 spanning-disabled
!
interface BVI1
ip address 10.xxxxx 255.xxxxxx
no ip route-cache
!
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
!
logging snmp-trap emergencies
logging snmp-trap alerts
logging snmp-trap critical
logging snmp-trap errors
logging snmp-trap warnings
tacacs-server host 10.xxxxx
tacacs-server directed-request
tacacs-server key 7 xxxxx
radius-server attribute 32 include-in-access-req format
radius-server host 10.xxxxx auth-port 1812 acct-port 1813 key 7 xxxxxx
radius-server vsa send accounting!
control-plane
!
bridge 1 route ip
!
line con 0
xxxx
line vty 0 4
xxxxx
line vty 5 15
xxxxxxl
!
end
