Trouble having WLC WLANs at site go to separate DHCP servers

[bloosz]

I have a WLC5508 at the main campus and am out at a high school where I have an AP 1252.

One WLAN is for the teachers and students to get access to their VLAN 2. 

I have WEP authentication on this WLAN and it grabs DHCP from their WIndows 2003 Server fine.

The other is a "Guest" WLAN

This WLAN is to communicate on a separate VLAN333 that just gets people internet connectivity.  No server from VLAN2.

I have their ASA5505 dishing out DHCP for vlan333 but when I choose the "Guest" WLAN, I am unable to get an IP address even though I have set the override in the advanced tab of the WLAN.

School VLAN is 192.168.2.x  and the Guest VLAN is 192.168.190.x

Guest VLAN configured on 2950 switch and ASA fasteth0/3.

DOn't know why the WLAN can't get dhcp address from the ASA?

[Surendra BG]

Disable DHCP proxy on the WLC and try connecting a client.. and see if we are able to grab the IP..

Controller >> Advanced >> DHCP >> DHCP proxy >> Uncheck >> Apply.

Regards
Surendra

[bloosz]

Thanks for the quick response but still no luck grabbing an IP from the ASA. The WLAN security I have on this "Guest" WLAN is Web Authentication. Not sure if that makes any difference.

Any other ideas?

[Nicolas Darchis]

What Surendra forgot to mention is that if you go for "config dhcp proxy disable", then you need to configure a ip helper on the gateway interface for the client vlan. And that ip helper should point to the ASA.

The trick is that the WLC normally proxies the DHCP request to the server (ASA) but for some reason I forgot, the ASA doesn't like when WLC does this. So if you disable dhcp proxy, the WLC will just let the dhcp broadcast through. But if the ASA is not present in that subnet, nothing will happen unless you configure an ip helper towards ASA on the gateway of the clients.

Nicolas

===

don't forget to rate answers that you find useful

[bloosz]

OK. VLAN333 is the "Guest" VLAN I'm having trouble with.

The ASA's ethernet0/3 switchport is configured for vlan333 access and is plugged into a 2950 switch port also configured for vlan333 access.

The ASA is my dhcp server and gateway.

So does the ip helper-address line go on the ASA on the vlan333 interface or on the switchport interface ethernet0/3?

Or

Does it go on the 2950's vlan in or switchport int?

[Nicolas Darchis]

It goes on the Vlan interface. But it shouldn't be needed if your ASA is also present on that vlan with a layer 3 interface.

Nicolas