Intra-vlan blocked communications

[Josh Norrick]

We are running a 9800-40 with version 17.9.3 with APs in local mode with central switching.   We have an issue with devices on the same VLAN that cannot communicate together.  They can ping other VLANs on either wireless or wired but intra-vlan communication is non-existent.  I've had a TAC case open for almost 2 months, we had to re-queue a couple of weeks ago due to our agent going down a rabbit hole that wasn't solving anything and had to reach out to our support team in order to get any contact from him.

This started out with a WLAN that is exclusively used for an iPad and a couple of Sonos speakers for an on-demand music request service we have in our dining area.  This worked on the AireOS controllers we replaced over the summer.  It has escalated, as we started testing, to now we are trying to connect to a wireless Solstice adapter for a projector and devices cannot communicate on the same VLAN.

EX: Cell Phone is on 10.108.4.33 and Solstice is 10.108.4.34.  I can ping in and out from anything that is not 10.108.4.0/24.

First thing we tried was making sure P2P Blocking was set to disabled.  There are no ACLs on the vlan either on the the controller or on any of the routers.

[Scott Fella]

That is interesting and also not easy to figure out.  I have ran into some issues during my testing with various code version and one of the things I do is first to build a new vlan or use an existing with a new SSID to see if I have the same experience or not.  The other thing I have done was to setup an AP in FlexConnect, configure the switchport to trunk, setup a FlexConnect SSID, etc. and again see what happens.  I have noticed that when I don't send traffic to the controller, I can get devices to see each other or mDNS/bonjour to work as an example.  These types of testing can help isolate what and where the issue is.  It takes some work, but gathering data is the way you can figure out what is wrong.

[marce1000]

 - Have a checkup of the 9800-40  controller configuration with the CLI command show tech wireless ; feed the output into :
                                                                                                            https://cway.cisco.com/wireless-config-analyzer/

  It may not lead to a direct breakthrough but remains very useful to do as also reported here (e.g.) : This is so good

 M.

[Rich R]

Upgrade to 17.9.4 for a start - it's now the TAC recommended release (see link below).
Do you have arp proxy enabled? (try both on and off)
https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html#AddressResolutionProtocolARPproxy