DHCP droping issue on Cisco AP3802e and WLC 3504

[thuy.hoang]

Dear Buddy,

Im facing with an issue on my customer site.

There are 2x WLC 3504 connect 10 x Cisco AP3802e via Cisco switch. I configure 2 SSID are Guest (with internal dhcp in WLC) and Test (Customer's DHCP server in same subnet). Every devices can access to Guest and Test normally, but there are 2 smartphones (Xiaomi brand) could not access to Test. I run debug client on WLC and get the output like this :

(Cisco Controller) >debug client f4:60:e2:dc:0b:e8

(Cisco Controller) >
(Cisco Controller) >
(Cisco Controller) >*DHCP Socket Task: May 20 13:50:24.103: [PA] f4:60:e2:dc:0b:e8 DHCP received op BOOTREQUEST (1) (len 316,vlan 1, port 8, encap 0xec00, xid 0x110e1dee)
*DHCP Socket Task: May 20 13:50:24.104: [PA] f4:60:e2:dc:0b:e8 DHCP dropping packet (no mscb) found - (giaddr 0.0.0.0, pktInfo->srcPort 68, op: 'BOOTREQUEST')
*DHCP Socket Task: May 20 13:50:24.601: [PA] f4:60:e2:dc:0b:e8 DHCP received op BOOTREPLY (2) (len 308,vlan 1, port 8, encap 0xec00, xid 0x110e1dee)
*DHCP Socket Task: May 20 13:50:24.601: [PA] f4:60:e2:dc:0b:e8 DHCP dropping packet (no mscb) found - (giaddr 0.0.0.0, pktInfo->srcPort 67, op: 'BOOTREPLY')
*DHCP Socket Task: May 20 13:50:24.711: [PA] f4:60:e2:dc:0b:e8 DHCP received op BOOTREQUEST (1) (len 328,vlan 1, port 8, encap 0xec00, xid 0x110e1dee)
*DHCP Socket Task: May 20 13:50:24.711: [PA] f4:60:e2:dc:0b:e8 DHCP dropping packet (no mscb) found - (giaddr 0.0.0.0, pktInfo->srcPort 68, op: 'BOOTREQUEST')
*DHCP Socket Task: May 20 13:50:25.071: [PA] f4:60:e2:dc:0b:e8 DHCP received op BOOTREPLY (2) (len 308,vlan 1, port 8, encap 0xec00, xid 0x110e1dee)
*DHCP Socket Task: May 20 13:50:25.071: [PA] f4:60:e2:dc:0b:e8 DHCP dropping packet (no mscb) found - (giaddr 0.0.0.0, pktInfo->srcPort 67, op: 'BOOTREPLY')

I tried to disable dhcp proxy on WLC but no luck. I am very sure that the issue is not from Radio setting because those 2 smartphones can access to Guest ssid.

Could anyone have experiences on this case?

Thanks.

Thuy Hoang

[Rafael E]

can you share the full debug from WLC for this Xiaomi client connecting to the Test SSID. Follow the next steps

turn off wireless connection on the phone 

remove client from WLC:  config client deauthenticate <mac address>

debug client <mac address>

turn on wireless card on the phone and connect it to Test SSID

[thuy.hoang]

Hi @Rafael E .

Thanks for your reply.

The log that I shared on first post is full debug output, I couldn't see anything more.

[Rafael E]

prior to DHCP we must see authentication and association request on WLC so the connection is allowed.

If you are not seeing that on the WLC means AP is not fwd that 

I would run debugs on AP and WLC at the same time 

AP 

exec-timeout 0 0

term len 0

show tech

config ap client-trace address add <>

config ap client-trace output console-log enable

config ap client-trace filter all enable

configure ap client-trace filter probe disable

config ap client-trace start

show ap client-trace status

term mon

[thuy.hoang]

Hi @Rafael E ,

After troubleshooting with your suggest debug, I found the root cause is layer 2 authentication setting on WLC and it looks like a bug with Android 10 devices.

You can follow below post as same issue with us. I already updated my issue and work around in this post below.

https://community.cisco.com/t5/wireless-and-mobility/wlc9k8-ap9k-android10-connectivity-issue/m-p/4089335/highlight/false#M116285

Anyway, we still not find out the best solution for this.

Thank you.

[Rafael E]

woow that thread is huge.... if you have the SR they use with TAC to track the issue i can take a look. 

[Scott Fella]

When you are testing, make sure the dhcp scope doesn’t overlap which can cause duplicate IP address. Also make sure that those phone don’t have MAC address randomizes enabled as that also can cause issue and use up dhcp leases. Look at the dhcp server logs and scope to make sure there are no errors too.

[thuy.hoang]

Hi @Scott Fella ,

Thanks for your suggestion, I will try to monitor the logs on DHCP Server then let see if can find out something.