Wireless Clients Get DHCP from WLC but Cannot Reach Internet – Routing

[phuocntlk135]

Hi Community,

I’m working on a deployment where the WLC (Wireless LAN Controller) is configured to provide internal DHCP for wireless clients connecting to specific SSIDs. The clients are successfully associating with the SSID and receiving IP addresses from the WLC’s DHCP scope.

The network topology includes a Layer 3 switch that handles inter-VLAN routing and connects to a firewall for internet access.

Note: I use WLC 9800-Cl deploy on VMware Workstation. Use my own laptop ro run WLC

---

🧩 Current Behavior:

• Wired (LAN) Clients:

  • Can reach the internet when assigned static IPs.

  • DHCP is not working for LAN clients (no IP assigned).

• Wireless Clients (connected to WLC SSID):

  • Successfully associate with the SSID.

  • Receive IP addresses from WLC’s internal DHCP server.

  • Cannot reach the internet.

---

Setup Overview:

• WLC is connected to the Layer 3 switch (trunk or access port).

• WLC is configured with internal DHCP scopes for wireless VLANs.

• Layer 3 switch has SVI interfaces for all VLANs (including VLAN for wireless clients).

• Default route on Layer 3 switch points to the firewall.

• Firewall provides NAT and internet access.

Questions:

1. Why are wireless clients able to get DHCP addresses but cannot access the internet?

2. Do I need to add any static routes or special configuration on the WLC or Layer 3 switch to ensure return traffic from wireless clients gets routed correctly?

3. Should the VLAN SVI used by wireless clients (e.g., VLAN 20 or VLAN 30) be created on the WLC, the L3 switch, or both?

4. If wireless traffic is locally switched, is the WLC expected to route traffic to the next hop (L3 switch or firewall), or is bridging enough?

5. Could missing trunk configuration or native VLAN mismatches between WLC and switch cause this issue?

[Rich R]

1. Why are wireless clients able to get DHCP addresses but cannot access the internet?We can't tell you why your network design doesn't work - you'll need to troubleshoot systematically and methodically.

2. Do I need to add any static routes or special configuration on the WLC or Layer 3 switch to ensure return traffic from wireless clients gets routed correctly?
   You probably do but same answer as 1.

3. Should the VLAN SVI used by wireless clients (e.g., VLAN 20 or VLAN 30) be created on the WLC, the L3 switch, or both?
   Only on L3 switch.  Best Practice (see link below) is that SVI should NOT be configured on WLC except where required for specific features.

4. If wireless traffic is locally switched, is the WLC expected to route traffic to the next hop (L3 switch or firewall), or is bridging enough?
   You need to understand the Cisco terminology.  If the AP is in Local Mode then the client traffic is Centrally Switched by the WLC (tunnelled from AP to WLC over CAPWAP). Without SVI on WLC (Best Practice) it is pure layer 2 (bridged) - the layer 3 functions are provided by switch/router/firewall.  If the AP is in Flexconnect Mode then the client traffic can be Locally Switched by the AP, which means the AP drops the traffic into a specified VLAN directly on the AP trunk port. (Flex AP can also support Centrally Switched WLANs).  Locally switched traffic is not tunnelled back to the WLC at all.  This is pure layer 2 - the AP simply bridges the traffic to the VLAN on the switch.

5. Could missing trunk configuration or native VLAN mismatches between WLC and switch cause this issue?
   Of course it could - that's absolute basics which you must get right!

Note that 9800-CL on VMware Workstation is not supported.
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-12/release-notes/rn-17-12-9800.html#Cisco_Concept.dita_c9f5f62c-3813-4ab2-9365-71d583c3a462
It is possible to make it work but requires some tweaks - you'll have to search for the details.