Cisco 9800-L -Client static IP Assignment not routing

[sejamc71]

We just deployed an HA pair of 9800-L WLCs. Ran into a weird issue. DHCP seems to be working as well as Static IP assignment, from 1 VLan, but static IPs from the other VLans are not. See below for the Tshooting steps I've completed. Worked with Cisco TAC for 4 hours yesterday and they were at a Loss. Resuming today, but wanted to present this to you folks and see if you've seen this before. I have verified that the Wireless VLans 66, 68 and 70 are configured exactly the same as VLan 64 on both the switch and the WLC. Thoughts?

1. 
   
   

[Scott Fella]

First off, did you test with a wired laptop on the same switch the controllers are connected to?  This will at least validate that everything is working on the wired side.  One the wireless, you just have to make sure that DHCP required is not enabled on the wlan, but I would think TAC would have reviewed that. 

Have you tried Mac reservations to see what the device obtains?  Verify that the gateway, subnet and dns servers are the same when you configure the static?

Validate step 4

Configuring the Internal DHCP Server Under a Wireless Policy Profile (GUI)

Procedure

---

Step 1	Choose Configuration > Tags & Profiles > Policy.
Step 2	Click a policy name.
Step 3	Click the Advanced tab.
Step 4	Under DHCP settings, check or uncheck the IPv4 DHCP Required check box and enter the DHCP Server IP Address.
Step 5	Click Update & Apply to Device.

[sejamc71]

I tested with a wired/wireless laptop and routing is functioning as expected. 1 IP, assigned to the Hardware NIC works and that same IP assigned to the Wireless NIC does not. I do have a MAC filter network, but am getting the same results. It connects, says "No Internet" and is not able to access resources. I am looking for the DHCP required setting now, but haven't found it as of yet. Still going through the WLC though.

[sejamc71]

I see the IPv4 DHCP Required option, but it doesn't appear to be selected.

[Scott Fella]

Well when you get "No Internet", that means you have a network connection, but either the gateway/subnet is wrong or DNS.  You validate your NAT settings for that subnet for internet?

[Scott Fella]

How is everything setup?  Local switching, flex connect? 

[sejamc71]

We have a mix. The remote sites are setup in Flex mode and are functioning normally. The local APs are in Local mode and are working fine with DHCP IPs

[Scott Fella]

The only work-around you have right now is to reserve the Mac address and just do DHCP.  I just tested my setup on FlexConnect and assigned my iPhone a static with no issues at all.  You have a 9800 in a lab you can test with?

[sejamc71]

I've checked all of the VLans on the WLC and all of the gateways and subnet masks are correct. If the IP is dhcp assigned, it works fine, but if it is statically assigned it doesn't. From the WLC Trouble Shooting page, I can, from the WLC, ping the gateways of each of the VLans and Traceroute to the core switch. If I take that Wireless IP and assign a physical switch port to that vlan, I am able to get to the internet just fine. If the IP is doled out via dhcp on the WLC, I can get to the internet fine, indicating that the gateways and masks are correct. The problem only exists on a Static assignment.

[Rich R]

You haven't fully described your setup - are you trying to use all those vlans in a group on a single WLAN?
If so then trying to force static IPs the way you are is not supported.

Also what version of software are you using?  Refer to TAC recommended versions below.

[sejamc71]

We are running a pair of 9800-L in an Active/Standby config. Remote offices are all set to Flex and the local Office APs are in Local mode. We have 3 Wireless subnets locally. Employee wireless and a Mac Filtering WLan are pointed at a VLan group for dhcp traffic and that all seems to be working perfectly. There are some Oracle printers and stuff that HAVE to have a static IP. Static IPs are pulled from a DHCP exclusion list and assigned to the devices. DHCP and Static IPs from VLan 64 are working fine. DHCP from VLans 66 and 68 are working fine. Static IPs from VLan 66 and 68 are not working. All subnets exists on the same core switches, all SVIs on the WLC and VLans are built exactly the same but when you assign a static from 66 or 68 on the printer or even a test laptop, you can't ping the gateway of the subnet and you can't get on the network. Cisco TAC said they were stumped and I've been working with them for 2 days. I'm not sure they are looking at the right component.

[Scott Fella]

So... you mentioned vlan group... vlan group is not defined for vlan 66 or 68 correct, because vlan group does not support static address.

[sejamc71]

VLans are created and we DO HAVE a Vlan Group defined which includes Vlan 64, 66, 68, and 70. On the 5508, you have the ability to specify an IP address when you add a device to MAC Filtering. We had a Cisco Consultant build the basic config for the new controller and on the new 9800s, there is an "Attribute" field which you can define that is supposed to direct the the group to a specific VLan per device.

[Scott Fella]

There are other post on the forum regarding vlan groups and static address not working.  Its also stated in the configuration guide.  It works on AireOS, but not on the 9800's.

[sejamc71]

It was decided that a Cisco Consultant should build out the new controllers as part of the project. I'm guessing that was money well spent.