Problem with 9800 WLC, native vlan and client vlan

[DavidRoss]

Hi i have this problem

I have to migrate all the access points to a management vlan, previously i had the access points that took ips from the same client ssid for clients (CLIENTS) that is the vlan1 (to be clear the ssid gave the same ips from the vlan 1/CLIENTS to aps and clients)

Now i put this kind of configuration on the switch interface connected to the access point:

description AP 
switchport trunk native vlan 6
switchport trunk allowed vlan 1,6
switchport mode trunk

We have created a layer 3 vlan interface that gives the ips (relays to a dhcp server) for the vlan 6 to the APs, and it is good, but the problem is that clients connected to ssid CLIENTS that should receive ips from vlan 1 they take ips from vlan 6 (same vlan that is the management vlan for the aps)

Do you know how to solve tis problem?

Thank you!

[marce1000]

 - Are you using APs in Flexconnect mode ? Otherwise the APs don't need a trunk configuration on the connected ports and just access mode with the correct (capwap) vlan (?). As for client DHCP solutions , consider https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html#DHCPbridgingandDHCPrelay 
                                      being best practice(s)

        You should probably abandon vlan1 too and use another vlan(/wlan) for the clients.

   As for all configuration (attempts) on the 9800 platform validate any configuration with the CLI command show tech wireless
   Feed the output into : Wireless Config Analyzer   , consider this kind of mandatory and very useful as reported by other experiences from a customer (e.g.) : This is so good

 M.

[DavidRoss]

Thank you for the rply, Yes, we are using the ap in flexconnect mode (sorry, i didn't specify it previously). To abandon vlan 1 for me is a problem , do you think that that is the problem? Is there another solution for you?

[marce1000]

                               >... receive ips from vlan 1 they take ips from vlan 6 
  (Ok = flexconnect) , (correcting reply because the earlier link was for aireos)
 : Ref : https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213945-understand-flexconnect-on-9800-wireless.html
         >....In FlexConnect APs with locally switched WLANs, the traffic is switched at the AP and the DHCP requests from the client goes into the wired network by the AP interface directly. The AP does not have any SVI in the client subnet, so it is not able to do DHCP proxy; and thus, the DHCP relay configuration (DHCP Server IP Address), in the Policy Profile > Advanced tab, has no meaning for locally switched WLANs. In these scenarios, the switchport needs to allow the client VLAN and then, if the DHCP server is in a different VLAN, configure the IP helper in the client SVI/default gateway so it knows where to send the DHCP request from the client.
                               Make sure the client finds the correct ('and only')  DHCP server first

                              and also  run the WirelessAnalyzer procedure as explained (when changing configurations on the 9800)

 M.

[Rich R · Accepted solution]

- Is the SSID central or locally switched?
To do what you want to (AP management on VLAN 6, clients on VLAN 1) your switch port config looks correct.
The fact that clients are landing in VLAN 6 means either your flexconnect profile is wrong or you're centrally switching them to the AP VLAN on the WLC...

Your flex profile should contain something like:
wireless profile flex clients
 native-vlan-id 6
 vlan-name CLIENTS
  vlan-id 1
 

And then the site tag:
wireless tag site my-aps
ap-profile my-ap-profile
flex-profile clients
no local-site

And the WLAN:
no central association
no central authentication
no central dhcp
no central switching

And make sure you're using up to date code as per the TAC recommended link below (currently 17.9.4)