showing ip theft error log in DNA for wireless client(MACbook)

[sming.ib.96]

we have 9800 WLC.

one of our MacBook laptop (version 10.5) getting a disconnection issue for SSID.

as we check the radio trace we didn't find error/disconnection logs.

was found some ARP logs. these logs are coming so many times.Attached the screen shot

client is going for the DHCP process multiple times. the DHCP lease time is one day

as we checked in DNA we saw an IP theft error log.(attached screen shot)

client can authenticate and onboard successfully.

AP is in local mode, central switching and authentication are on.

is this a DHCP issue? or Endpoint misbehavior ?

[balaji.bandi]

check below guide to help you :

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/16-11/config-guide/b_wl_16_11_cg/ip-theft.html

how is your DHCP configured lease time ? is this happening Roaming ?

[Rich R]

We can't answer this fully without all the info - at a minimum what version of software running on your WLC and what is the network design/setup and how is the WLAN configured.

Depending on the answers to that there's a good chance you're running into a very well known deficiency with the early 9800 IOS-XE releases which was fixed in 17.3.3 and 17.4.1 and later releases and requires configuration applied once you are running a release which supports it.  The WLC did not allow overlapping IPs even for locally switched flexconnect WLANs meaning IPs had to be globally unique across all APs on the WLC otherwise it treats them as IP theft.

Details:  https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr98802

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-4/config-guide/b_wl_17_4_cg/m_vewlc_flex_connect.html#concept_hvw_sjw_clb (scroll down to next heading Overlapping Client IP Address in Flex Deployment)

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-3/release-notes/rn-17-3-9800.html#Cisco_Concept.dita_601fcfe9-f419-47fa-8ca9-125878f71c48