WLC and DHCP issue

[frederick.mercado]

Good day!

Need help in our WLC setup. We have a flex connect site. I have a 9800 WLC and 9210 AP that I am setting up so far. Service Port is enabled for OOB mngmt, and 0/1/0 is trunked for all VLAN traffic. The WLC is setup on the same VLAN as the APs (xx). I was able to setup RADIUS with PEAP and get a client to authenticate, however it shows "IP Learn" and will not pull an IP with VLAN xx(default).

[Flavio Miranda]

If the access point is in flexconnect mode, then put the interface in trunk mode and the vlan it uses to communication with WLC as native vlan.

Then define which vlan the client should get ip address from and allow it on the trunk as well. 

[MHM Cisco World]

sorry 
what is WLC native VLAN ?
what is AP native VLAN?
are AP-SW trunk allow VLAN and native VLAN is same as config in WLC?

[frederick.mercado]

WLC native is VLAN xx(management VLAN)

AP native VLAN is also same

[MHM Cisco World]

  Are you enable CoA under wlan ?

The vlan retrun from auth must override. 

[frederick.mercado]

I enabled Support for CoA under AAA RADIUS server but no change.

[MHM Cisco World]

then under the WLAN 
enable allow AAA override.

[frederick.mercado]

Enabled both. Still nothing. 

One thing I did notice is I am unable to ping the DHCP server from the CLI, but I heard this is iffy. 

[MHM Cisco World]

OK, Flex get the association client to VLAN22 
VLAN22 is allow in trunk config between the AP and SW?
this is Flex are the WLAN is local or central Switching ?
local switching meaning the flex must connect DHCP server 
central switching meaning the flex send the DHCP to WLC and WLC forward it to DHCP. 

[frederick.mercado]

Correct, client is associated with VLAN xx. 

Yes there is no restrictions to VLAN xx. 

Central . 

[frederick.mercado]

2022/03/29 20:03:52.853177 {wncd_x_R0-0}{1}: [client-orch-state] [16587]: (note): MAC: a0af.bd0f.8809 Client state transition: S_CO_DPATH_PLUMB_IN_PROGRESS -> S_CO_IP_LEARN_IN_PROGRESS
2022/03/29 20:05:52.853109 {wncd_x_R0-0}{1}: [client-orch-sm] [16587]: (ERR): MAC: a0af.bd0f.8809 Triggering notification for IP learn timeout
2022/03/29 20:05:52.853127 {wncd_x_R0-0}{1}: [ewlc-infra-evq] [16587]: (ERR): a0af.bd0f.8809 CLIENT_STAGE_TIMEOUT State = IP_LEARNING, WLAN profile = DATA, Policy profile = LSL/HXF_WLANID_1, AP name = LSL_Main_1
2022/03/29 20:05:52.853269 {wncd_x_R0-0}{1}: [client-orch-sm] [16587]: (note): MAC: a0af.bd0f.8809 Client delete initiated. Reason: CO_CLIENT_DELETE_REASON_IPLEARN_CONNECT_TIMEOUT, fsm-state transition 00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|01|07|13|17|18|28|33|42|44|46|48|53|
2022/03/29 20:05:52.853387 {wncd_x_R0-0}{1}: [client-orch-sm] [16587]: (note): MAC: a0af.bd0f.8809 Delete mobile payload sent forbssid: 1006.ed3f.1d6f WTP mac: 1006.ed3f.1d60 slot id: 1
2022/03/29 20:05:52.853408 {wncd_x_R0-0}{1}: [client-orch-state] [16587]: (note): MAC: a0af.bd0f.8809 Client state transition: S_CO_IP_LEARN_IN_PROGRESS -> S_CO_DELETE_IN_PROGRESS
2022/03/29 20:05:52.853732 {wncd_x_R0-0}{1}: [dpath_svc] [16587]: (note): MAC: a0af.bd0f.8809 Client datapath entry deleted for ifid 0xa0000002
2022/03/29 20:05:52.853892 {wncd_x_R0-0}{1}: [sanet-shim-translate] [16587]: (note): MAC: a0af.bd0f.8809 Session manager disconnect event called, session label: 0xb1000100
2022/03/29 20:05:52.854875 {wncd_x_R0-0}{1}: [client-orch-state] [16587]: (note): MAC: a0af.bd0f.8809 Client state transition: S_CO_DELETE_IN_PROGRESS -> S_CO_DELETED
2022/03/29 20:05:55.461907 {wncd_x_R0-0}{1}: [client-orch-sm] [16587]: (note): MAC: a0af.bd0f.8809 Association received. BSSID 1006.ed3f.1d6f, WLAN DATA, Slot 1 AP 1006.ed3f.1d60, LSL_Main_1
2022/03/29 20:05:55.462048 {wncd_x_R0-0}{1}: [client-orch-state] [16587]: (note): MAC: a0af.bd0f.8809 Client state transition: S_CO_INIT -> S_CO_ASSOCIATING
2022/03/29 20:05:55.462224 {wncd_x_R0-0}{1}: [dot11-validate] [16587]: (ERR): MAC: a0af.bd0f.8809 Failed to validate dot11r pmkid. PMK cache not found
2022/03/29 20:05:55.462462 {wncd_x_R0-0}{1}: [dot11] [16587]: (note): MAC: a0af.bd0f.8809 Association success. AID 1, Roaming = False, WGB = False, 11r = True, 11w = False
2022/03/29 20:05:55.462566 {wncd_x_R0-0}{1}: [client-orch-state] [16587]: (note): MAC: a0af.bd0f.8809 Client state transition: S_CO_ASSOCIATING -> S_CO_L2_AUTH_IN_PROGRESS
2022/03/29 20:05:55.462660 {wncd_x_R0-0}{1}: [client-auth] [16587]: (note): MAC: a0af.bd0f.8809 ADD MOBILE sent. Client state flags: 0x31 BSSID: MAC: 1006.ed3f.1d6f capwap IFID: 0x9000000a
2022/03/29 20:05:55.465637 {wncd_x_R0-0}{1}: [client-auth] [16587]: (note): MAC: a0af.bd0f.8809 L2 Authentication initiated. method DOT1X, Policy VLAN 0,AAA override = 1 , NAC = 0
2022/03/29 20:05:55.465652 {wncd_x_R0-0}{1}: [sanet-shim-translate] [16587]: (ERR): a0af.bd0f.8809 wlan_profile Not Found : Device information attributes not populated
2022/03/29 20:05:55.466920 {wncd_x_R0-0}{1}: [ewlc-infra-evq] [16587]: (note): Authentication Success. Resolved Policy bitmap:15 for client a0af.bd0f.8809
2022/03/29 20:05:55.534106 {wncd_x_R0-0}{1}: [client-auth] [16587]: (note): MAC: a0af.bd0f.8809 L2 Authentication Key Exchange Start. Resolved VLAN: 22, Audit Session id: C81F4A0A0000010BD748EC42
2022/03/29 20:05:55.542572 {wncd_x_R0-0}{1}: [client-keymgmt] [16587]: (note): MAC: a0af.bd0f.8809 EAP Key management successful. AKM:FT-DOT1X Cipher:CCMP WPA Version: WPA2
2022/03/29 20:05:55.542703 {wncd_x_R0-0}{1}: [client-orch-sm] [16587]: (note): MAC: a0af.bd0f.8809 Mobility discovery triggered. Client mode: Flex - Central Switching
2022/03/29 20:05:55.542707 {wncd_x_R0-0}{1}: [client-orch-state] [16587]: (note): MAC: a0af.bd0f.8809 Client state transition: S_CO_L2_AUTH_IN_PROGRESS -> S_CO_MOBILITY_DISCOVERY_IN_PROGRESS
2022/03/29 20:05:55.543378 {wncd_x_R0-0}{1}: [mm-client] [16587]: (note): MAC: a0af.bd0f.8809 Mobility Successful. Roam Type None, Sub Roam Type MM_SUB_ROAM_TYPE_NONE, Client IFID: 0xa0000002, Client Role: Local PoA: 0x9000000a PoP: 0x0
2022/03/29 20:05:55.543531 {wncd_x_R0-0}{1}: [client-auth] [16587]: (note): MAC: a0af.bd0f.8809 ADD MOBILE sent. Client state flags: 0x32 BSSID: MAC: 1006.ed3f.1d6f capwap IFID: 0x9000000a
2022/03/29 20:05:55.543567 {wncd_x_R0-0}{1}: [client-orch-state] [16587]: (note): MAC: a0af.bd0f.8809 Client state transition: S_CO_MOBILITY_DISCOVERY_IN_PROGRESS -> S_CO_DPATH_PLUMB_IN_PROGRESS
2022/03/29 20:05:55.543660 {wncd_x_R0-0}{1}: [dot11] [16587]: (note): MAC: a0af.bd0f.8809 Client datapath entry params - ssid:DATA_NEW,slot_id:1 bssid ifid: 0x90000007, radio_ifid: 0x90000002, wlan_ifid: 0xf0400001
2022/03/29 20:05:55.543876 {wncd_x_R0-0}{1}: [dpath_svc] [16587]: (note): MAC: a0af.bd0f.8809 Client datapath entry created for ifid 0xa0000002
2022/03/29 20:05:55.544077 {wncd_x_R0-0}{1}: [client-orch-state] [16587]: (note): MAC: a0af.bd0f.8809 Client state transition: S_CO_DPATH_PLUMB_IN_PROGRESS -> S_CO_IP_LEARN_IN_PROGRESS
2022/03/29 20:07:55.544306 {wncd_x_R0-0}{1}: [client-orch-sm] [16587]: (ERR): MAC: a0af.bd0f.8809 Triggering notification for IP learn timeout
2022/03/29 20:07:55.544325 {wncd_x_R0-0}{1}: [ewlc-infra-evq] [16587]: (ERR): a0af.bd0f.8809 CLIENT_STAGE_TIMEOUT State = IP_LEARNING, WLAN profile = DATA, Policy profile = LSL/HXF_WLANID_1, AP name = LSL_Main_1
2022/03/29 20:07:55.544483 {wncd_x_R0-0}{1}: [client-orch-sm] [16587]: (note): MAC: a0af.bd0f.8809 Client delete initiated. Reason: CO_CLIENT_DELETE_REASON_IPLEARN_CONNECT_TIMEOUT, fsm-state transition 00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|00|01|07|13|17|18|28|33|42|44|46|48|53|
2022/03/29 20:07:55.544601 {wncd_x_R0-0}{1}: [client-orch-sm] [16587]: (note): MAC: a0af.bd0f.8809 Delete mobile payload sent forbssid: 1006.ed3f.1d6f WTP mac: 1006.ed3f.1d60 slot id: 1
2022/03/29 20:07:55.544612 {wncd_x_R0-0}{1}: [client-orch-state] [16587]: (note): MAC: a0af.bd0f.8809 Client state transition: S_CO_IP_LEARN_IN_PROGRESS -> S_CO_DELETE_IN_PROGRESS

[MHM Cisco World]

VLAN22-SW1#ip helper-address x.x.x.x redundancy NAME
!
VLAN22-SW2#ip helper-address x.x.x.x redundancy NAME

check this solution, 

you config the HSRP and config the ip-helper address but which peer will forward the DHCP and which one will receive it and return it to WLC ?
so you need this feature to make HSRP DHCP-AWARE.
hope this is solution here.

[frederick.mercado]

Realized this was working with an older WLC offsite, and we did not have the above configuration. So I went back to the drawing board. I found out that if I simply added an IP address to the SVI (VLANxx) it works. That simple. Its odd that the interface requires an IP? But I figured since the packet tracing shows 0.0.0.0 as originating, perhaps something was a miss. Any idea why?

[MHM Cisco World]

Yes,

Dhcp relay will

Receive broadcast convert to unicast 

IP ADD source is SVI and destiantion is dhcp server.

[Arshad Safrulla]

Even though your AP's are in Flex connect mode SSID's are being switched locally as per your configuration. So you have 2 options from your side.
1. Configure WLC uplink as trunk (recommended) and allow all the wireless VLAN's tagged to SSID's
2. Configure the below under the policy profiles per SSID.
no central association
no central dhcp
no central switching

In first case all your traffic will be switched centrally and configuration changes required are minimal. In second case configuration changes required will be more and traffic will be locally switched AP level.

Change the WLC port config from core switch as below:

interface GigabitEthernet1/0/45
no switchport trunk native vlan 31
switchport trunk allowed vlan 31,(Centrally switched Wireless VLAN's)
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
You don't need this VLAN in your WLC considering this is not the WMI and no mdns required.
no interface Vlan22
description WIRELESS CLIENT VLAN
no ip address
ip helper-address 10.74.35.10
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Do the below changes in WLC uplink

interface TenGigabitEthernet0/1/0
description Trunked connection to ***
no switchport access vlan 22
switchport mode trunk
switchport trunk allowed vlan 31,(Centrally switched Wireless VLAN's)
no ip access-group implicit_permit in
no ip access-group implicit_permit out
negotiation auto
no snmp trap link-status
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!