CISCO 9800-L Controller internal dhcp not working

[amarnauth.persaud]

Hi All,

  I have been trying to configure a guest network for my Cisco Catalyst 9800-L Wireless Controller for some days now. For the guest network, i want it to use an internal dhcp on the controller. I have been trying for days now, however, when a client connects to guest network it does not receive a DHCP IP address. 

POOL: 
ip dhcp pool localpool
network 10.10.96.0 255.255.248.0
default-router 10.101.11.1
dns-server 8.8.8.8 1.1.1.1 10.101.11.1
lease infinite

SVI of vlan 10 was created for DHCP pool

interface Vlan10
description VLAN 10
ip address pool localpool
ip helper-address 10.25.13.73
no autostate

Management is on : GigabitEthernet0

and TwoGigabitEthernet0/0/3 will provide internet connectivity for guest network - gateway is 10.101.11.1

Guest network policy snaps:

Hoping to get some help. First time I am configuring a CISCO WLC 9800. I got the internal network wlan to work to radius server on Windows NPS but this guest network using internal dhcp pool is a pain.

Regards,

Thanks in advance. 

[Flavio Miranda]

Hi @amarnauth.persaud 

Not sure if this config is correct

nterface Vlan10
description VLAN 10
ip address pool localpool
ip helper-address 10.25.13.73
no autostate

On the link below the dude do exactly what you are trying.

https://wifininjas.net/2019/08/06/wn-blog-007-c9800-wlc-internal-dhcp-server-config/

[amarnauth.persaud]

Hi Flavio,

  I have tried the link you suggested but issue still is the same. 

Regards,

Amar

[Flavio Miranda]

But did you find any difference on the config?

 Let me ask you about the SSID you create. Is it in flexconnect mode?  I mean, the client is asking for IP on the local LAN ?

[amarnauth.persaud]

Hi @Flavio Miranda ,
This is the stats for a connected client. 

MAC Address

Client MAC Type

Universally Administered Address

Client DUID

NA

IPV6 Address

fe80::badf:4

User Name

N/A

Policy Profile

GUESTPROFILE

Flex Profile

N/A

Wireless LAN Id

4

WLAN Profile Name

test

Wireless LAN Network Name (SSID)

apple

BSSID

c8

Uptime(sec)

69 seconds

Idle state timeout

N/A

Session Timeout

1800 sec (Timer not running)

Session Warning Time

Timer not running

Client Active State

Active

Power Save mode

ON

Current TxRateSet

6.0

Supported Rates

6.0,9.0,12.0,18.0,24.0,36.0,48.0,54.0

QoS Average Data Rate Upstream

0 (kbps)

QoS Realtime Average Data Rate Upstream

0 (kbps)

QoS Burst Data Rate Upstream

0 (kbps)

QoS Realtime Burst Data Rate Upstream

0 (kbps)

QoS Average Data Rate Downstream

0 (kbps)

QoS Realtime Average Data Rate Downstream

0 (kbps)

QoS Burst Data Rate Downstream

0 (kbps)

QoS Realtime Burst Data Rate Downstream

0 (kbps)

Join Time Of Client

08/01/2023 16:28:27 America

Policy Manager State

IP Learn

Last Policy Manager State

Mobility Complete

AAA override passphrase

No

Transition Disable Bitmap

None

User Defined (Private) Network

Disabled

User Defined (Private) Network Drop Unicast

Disabled

Encrypted Traffic Analytics

No

VLAN Override after Webauth

No

VLAN

VLAN10

Multicast VLAN

0

Central NAT

DISABLED

11v DMS Capable

No

QoS Map Capable

Yes

FlexConnect Data Switching

N/A

FlexConnect DHCP Status

N/A

FlexConnect Authentication

N/A

Client Scan Report Time

Timer not running

Max Client Protocol Capability

Wi-Fi6 (802.11ax)

WiFi to Cellular Steering

Not implemented

Cellular Capability

N/A

Regular ASR support

DISABLED

[Flavio Miranda]

I got it "Flex Profile"

 What you need to check is if the device when connect to the SSID have any layer3 device in between. It seems you put the ip helper-address on the WLC, right?    The helper-address is required if there is a layer3 device between client and wlc, not in the wlc.

[jagan.chowdam]

Have a look at the following link:

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/dhcp-for-wlans.html

Go through the following guidelines to configure internal DHCP server

General Guidelines

• Internal DHCP server serves both wireless client and wired client (wired client includes AP).

• To serve wireless client with internal DHCP server, an unicast DHCP server IP address must be configured for wireless client. Internal DHCP server IP address must be configured under the server facing interface, which can be loopback interface, SVI interface, or L3 physical interface.

• To use internal DHCP server for both wireless and wired client VLAN, an IP address must be configured under client VLAN SVI interface.

• For wireless client, in DHCP helper address configuration, the IP address of the internal DHCP server must be different from address of wireless client VLAN SVI interface.

• For wireless client with internal DHCP server support, the internal DHCP server can be configured using global configuration command, under the client VLAN SVI interface or under the wireless policy profile.

• An internal DHCP server pool can also serve clients of other controllers .

-CJ

[Rich R]

1. You should never use Infinite lease time on DHCP - that's a time bomb especially with random MAC addresses - your pool will slowly fill till no free IPs. Generally no more than 24 hours but where there's high churn much less.
2. I highly recommend using a static IP for the SVI - usually the first or last IP in the pool - remember to exclude that from the pool.
3. What is 10.25.13.73?  Because that is where you're sending your DHCP to at the moment!

[amarnauth.persaud]

Hi,
 The solution was creating a SVI interface on the same IP POOL as the GUEST NETWORK VLAN (From as the core network switch).

Then adjusting the policy to this:

Thanks for all the help.

[Rich R]

But you don't need an SVI for that to work unless you're using the SVI to relay using a helper address.