Duplicate IPv6 Client getting exluded in WLC due to IPTheft feature

[subodh goyal]

Hello Team,

2 different client devices are using same IPV6 address due to which, WLC is deleting those clients due to IPTheft feature.

Two different clients (286b.35a9.477d and 5c3a.453a.a41b) are using the same IPv6 address, which is not allowed for the WLC, due to which they are disconnected and consequently added into the exclusion list.

Even when the DHCP server is not providing this type of IP information, clients are still asking for it

Can you please confirm why client is using same IPv6 address for 2 different machines?

Also we are using the same setup for all sites in flex connect but only 1 site is impacted due to this.

Model- C9800-40-K9

Version- 17.9.6

Debug Logs:-

2025/03/27 09:33:06.483611489 {wncd_x_R0-4}{1}: [errmsg] [19084]: (note): %CLIENT_ORCH_LOG-5-ADD_TO_EXCLUSIONLIST_REASON: R0/4: wncd: Client MAC: 286b.35a9.477d with IP: fe80::bf58:740c:22c5:43e0 was added to exclusion list, legit Client MAC: 5c3a.453a.a41b, IP: fe80::bf58:740c:22c5:43e0, reason: IP address theft

[marce1000]

  - Not sure about the clients behavior but you can allow overlapping IP addresses using this settings :
     https://community.cisco.com/t5/wireless/wlc-9800-cl-client-exclusion-issue/m-p/4700373/highlight/true#M246927
     OR
     https://community.cisco.com/t5/wireless/chromebooks-amp-quot-client-is-blacklisted-due-to-ip-address/m-p/4701579/highlight/true#M247003
                        (which provides the same info's)

   M.

[subodh goyal]

IP overlap is already enabled

[Rich R]

You did not answer my previous question:
Are the clients at the same site (in which case your problem is a client addressing issue not a WLC issue) or at different sites?

And the follow on questions:
- Do you have unique site tags at each site?
- Is that Plant flex profile definitely applied to the APs in question?
"sh ap name <ap-name> tag detail" to confirm the tags applied to the AP.

[subodh goyal]

Are the clients at the same site (in which case your problem is a client addressing issue not a WLC issue) or at different sites? we are having mulitple sites with same flex profile (Plant) but only 1 site is impacted with this issue.

And the follow on questions:
- Do you have unique site tags at each site? Yes
- Is that Plant flex profile definitely applied to the APs in question? Correct
"sh ap name <ap-name> tag detail" to confirm the tags applied to the AP.

9800-ESPed-WLC#sh ap name PIMAP19 tag detail
AP Name : PIMAP19
AP Mac : 9077.ee9f.a43a

Tag Type Tag Name
-----------------------------
Policy Tag Plants-policy-tag
RF Tag Global_RF_tag
Site Tag PIMAD

Policy tag mapping
------------------
WLAN Profile Name Policy Name VLAN Flex Central Switching IPv4 ACL IPv6 ACL
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
gb-cpd-wlan-profile GB-CPD_Flex_Profile 400 DISABLED Not Configured Not Configured
gbimbo-wlan-profile GBimbo_Flex_Profile 310 DISABLED Not Configured Not Configured
gbwifi-wlan-profile GBWifi_Flex_Profile 310 DISABLED Not Configured Not Configured
gbguest-wlan-profile GBGuest_Central_profile 330 ENABLED Not Configured Not Configured
gbmobile-wlan-profile GBMobile_Flex_Profile 310 DISABLED Not Configured Not Configured
gbguest_vip-wlan-profile GBGuest_Central_profile 330 ENABLED Not Configured Not Configured

Site tag mapping
----------------
Flex Profile : Plant
AP Profile : Iberia-Global
Local-site : No

RF tag mapping
--------------
6ghz RF Policy : default-rf-profile-6ghz
5ghz RF Policy : Iberia_Global_5Ghz
2.4ghz RF Policy : Iberia_Global_2.4Ghz
2.4ghz slot 0 Radio Policy : Not Configured
5ghz slot 1 Radio Policy : Not Configured
5ghz slot 2 Radio Policy : Not Configured
6ghz slot 2 Radio Policy : Not Configured
6ghz slot 3 Radio Policy : Not Configured

[Rich R]

> Are the clients at the same site (in which case your problem is a client addressing issue not a WLC issue) or at different sites? we are having mulitple sites with same flex profile (Plant) but only 1 site is impacted with this issue.

Sorry but that still does not answer my question!
"Client MAC: 286b.35a9.477d with IP: fe80::bf58:740c:22c5:43e0 was added to exclusion list, legit Client MAC: 5c3a.453a.a41b, IP: fe80::bf58:740c:22c5:43e0"
There are 2 clients 286b.35a9.477d and 5c3a.453a.a41b. 
Are those 2 clients at the same site or on different sites?
Which WLAN are those clients on?

If they are at the same site, locally switched, then that is outside the control of the WLC and you need to investigate at the site because the WLC is just reporting what it's seeing.

[Scott Fella]

If you are not using ipv6, why not just disable it on the client or better yet on the controller.  Or else you are going to have to dig in to the clients and see how their ipv6, is it being auto configured or maybe static which I doubt.

[subodh goyal]

by default IPv6 is enabled on all endpoint devices but only 1 location is affected..

[Scott Fella]

It's an easy fix to disable it if you are not using it.  One site for now, but that will grow and might start to happen to other devices in the future.  There is no need to enable ipv6 unless you are using it.

[Rich R]

Are the clients at the same site (in which case your problem is a client addressing issue not a WLC issue) or at different sites?

If they're at different sites then this is clearly covered in multiple places in the Best Practices guide (link below).  You must ensure they use different site tags and you must enable "ip overlap" in the flex profile.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/technical-reference/c9800-best-practices.html#FlexConnectsitetag
See the Overlapping Client IP Address in Flex Deployment section at https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-12/config-guide/b_wl_17_12_cg/m-sniffer-cg.html#proxy-arp-for-flex-wireless

[subodh goyal]

IP overlap is already enabled.

[marce1000]

- @subodh goyal  -    Do the clients effectively use and or need ipv6  addresses ?

     M.