DHCP Server functionallity with 310i as VC

[Matheus_Santana]

Hello, 

I have an AP310i as a VC in a site, where it adopts APs 7522. In addition to the native VLAN 1, I need to deliver IP to two other different VLANs, for that, I created DHCP servers in the controller. This configuration is identical to another site, where I have an RFS6000 as controller, and everything is working correctly, however, with the 310i as VC, the adopted APs do not deliver IP through this DHCP Server.

Here is the running config of AP310i (VC):

!
! Configuration of AP310 version 7.6.2.0-018R
!
!
version 2.7
!
!
client-identity-group default
 load default-fingerprints
!
ip access-list BROADCAST-MULTICAST-CONTROL
 permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"
 permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"
 deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"
 deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"
 deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"
 permit ip any any rule-precedence 100 rule-description "permit all IP traffic"
!
mac access-list PERMIT-ARP-AND-IPv4
 permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"
 permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"
!
ip snmp-access-list default
 permit any
!
firewall-policy default
 no ip dos tcp-sequence-past-window
 no stateful-packet-inspection-l2
 ip tcp adjust-mss 1400
!
!
mint-policy global-default
!
meshpoint-qos-policy default
!
wlan-qos-policy default
 qos trust dscp
 qos trust wmm
!
radio-qos-policy default
!
aaa-policy RADIUS_FOGAS
 authentication server 1 host 191.1.10.3 secret 0 fogas123
 authentication server 1 proxy-mode through-controller
!
wlan Fogas_Corporativo
 description Fogas_Corporativo
 ssid Fogas_Corporativo
 vlan 1
 bridging-mode local
 encryption-type ccmp
 authentication-type eap
 no multi-band-operation
 use aaa-policy RADIUS_FOGAS
!
wlan Fogas_Mobile
 description Fogas_Mobile
 ssid Fogas_Mobile
 vlan 40
 bridging-mode tunnel
 encryption-type tkip-ccmp
 authentication-type none
 no multi-band-operation
 no protected-mgmt-frames
 wpa-wpa2 psk 0 Fogas@123
!
wlan Fogas_Visitante
 description Fogas_Visitante
 ssid Fogas_Visitante
 vlan 50
 bridging-mode tunnel
 encryption-type none
 authentication-type none
 no multi-band-operation
 no protected-mgmt-frames
 time-based-access days all start 06:00 end 19:00
!
smart-rf-policy default
 no select-shutdown
 no smart-sensor
 smart-sensor auto-trigger
 smart-sensor band smart-band-5GHz
 smart-sensor tri-radio-only
!
auto-provisioning-policy APP-FOGAS
 adopt ap7522 precedence 1 profile AP-7522 rf-domain default ip 10.8.0.0/16 
!
radius-server-policy default
 nas 191.1.10.3/32 secret 0 fogas123
!
dhcp-server-policy DHCP_FOGAS
 bootp ignore
 dhcp-pool vlan40
  network 192.168.48.0/24
  address range 192.168.48.10 192.168.48.254 
  default-router 192.168.48.1
  dns-server  191.1.10.1 172.28.123.21
 dhcp-pool vlan50
  network 192.168.58.0/24
  address range 192.168.58.10 192.168.58.99 
  default-router 192.168.58.1
  dns-server  8.8.8.8 8.8.4.4
!
!
management-policy default
 telnet
 no http server
 https server
 rest-server
 ssh
 user admin password 1 8553661a49b0c8a0856a3ee27bfc63a1a5a14b39861bdb89af85a547fbb8d899 role superuser access all
 snmp-server community 0 private rw
 snmp-server community 0 public ro
 snmp-server user snmptrap v3 encrypted des auth md5 0 admin123
 snmp-server user snmpmanager v3 encrypted des auth md5 0 admin123
!
event-system-policy default
!
profile anyap AP-7522
 ip default-gateway 10.8.100.200
 no autoinstall configuration
 no autoinstall firmware
 crypto ikev1 policy ikev1-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ikev2 policy ikev2-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
 crypto ikev1 remote-vpn
 crypto ikev2 remote-vpn
 crypto auto-ipsec-secure
 crypto load-management
 crypto remote-vpn-client
 interface radio1
  wlan Fogas_Corporativo bss 1 primary
  wlan Fogas_Visitante bss 2 primary
  wlan Fogas_Mobile bss 3 primary
 interface radio2
  wlan Fogas_Corporativo bss 1 primary
  wlan Fogas_Visitante bss 2 primary
  wlan Fogas_Mobile bss 3 primary
 interface radio3
 interface bluetooth1
  shutdown
  mode bt-sensor
 interface up1
  switchport mode trunk
  switchport trunk allowed vlan 1,40,50
 interface eth0
 interface eth1
 interface eth2
 interface eth3
 interface ge1
  switchport mode trunk
  switchport trunk allowed vlan 1,40,50
 interface ge2
 interface fe1
 interface fe2
 interface fe3
 interface fe4
 interface vlan1
  ip address dhcp
 interface pppoe1
 use dhcp-server-policy DHCP_FOGAS
 use firewall-policy default
 use auto-provisioning-policy APP-FOGAS
 service pm sys-restart
 router ospf
 adoption-mode controller
!
profile ap310 default-ap310
 ip name-server 191.1.10.1
 ip name-server 191.1.10.3
 ip name-server 172.28.123.21
 ip domain-name fogas.local
 ip default-gateway 10.8.100.200
 autoinstall configuration
 autoinstall firmware
 crypto ikev1 policy ikev1-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ikev2 policy ikev2-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
 crypto ikev1 remote-vpn
 crypto ikev2 remote-vpn
 crypto auto-ipsec-secure
 crypto load-management
 crypto remote-vpn-client
 interface radio1
  wlan Fogas_Corporativo bss 1 primary
  wlan Fogas_Mobile bss 2 primary
  wlan Fogas_Visitante bss 3 primary
  antenna-mode 2x2
 interface radio2
  wlan Fogas_Corporativo bss 1 primary
  wlan Fogas_Mobile bss 2 primary
  wlan Fogas_Visitante bss 3 primary
  antenna-mode 2x2
 interface bluetooth1
  shutdown
  mode le-sensor
 interface ge1
  description "Vlan Rede Local"
 interface ge2
  description "Vlan Rede Sem Fio"
 interface vlan1
  ip address dhcp
  ip dhcp client request options all
 interface pppoe1
 interface usb0
 use dhcp-server-policy DHCP_FOGAS
 no use firewall-policy
 ntp server a.ntp.br 
 use client-identity-group default
 no virtual-controller management-interface ip address
 logging on
 service pm sys-restart
 router ospf
 adoption-mode controller
!
rf-domain default
 location Cuiaba
 contact suporte@fogas.com.br
 timezone Etc/GMT-4
 country-code br
 ad-wips-wireless-mitigation disable
 ad-wips-wired-mitigation disable
!
ap7522 94-9B-2C-2A-DB-AC
 use profile AP-7522
 use rf-domain default
 hostname AP-CGB02-ADM01
 area Administracao
 floor Administracao
 interface vlan1
  ip address 10.8.5.1/16
  ip address zeroconf secondary
!
ap310 20-9E-F7-78-F5-91
 use profile default-ap310
 use rf-domain default
 hostname AP-CGB-ADM01
 area CONTROLLER
 use radius-server-policy default
 interface radio1
  wlan Fogas_Corporativo bss 1 primary
  wlan Fogas_Visitante bss 2 primary
  wlan Fogas_Mobile bss 3 primary
  ldpc
 interface radio2
  wlan Fogas_Visitante bss 1 primary
  wlan Fogas_Mobile bss 2 primary
  wlan Fogas_Corporativo bss 3 primary
  ldpc
 interface ge2
  switchport mode trunk
  switchport trunk allowed vlan 1,40,50
  switchport trunk native vlan 1
 interface vlan1
  ip address 10.8.5.2/16
  ip address zeroconf secondary
 interface vlan40
  ip address 192.168.48.3/24
 interface vlan50
  ip address 192.168.58.3/24
 use dhcp-server-policy DHCP_FOGAS
 no use auto-provisioning-policy
 virtual-controller
 rf-domain-manager capable
 no adoption-mode
!
!
end

[ckelly]

Matheus, I misunderstood something. I thought the issue was that the AP310i was not getting a DHCP lease on those VLANs. Going back and re-reading your original post, the problem is instead that the wireless clients using those VLANs on the adopted 7522’s are not getting leases.

But regardless, if the VC AP (or even controller or regular AP) is going to be running a DHCP service, an SVI is required for the DHCP service to operate on that VLAN. So for the 310i VC, those SVI’s needed to be there, so this was at least PART of the problem.

Let’s start first by checking for the DHCP service on the VC.  Run:

show ip dhcp status

You can then check for leases using:

show ip dhcp binding

[Matheus_Santana]

You will notice that the settings of this AP and the 310i controller are different, this is because this AP is on another site, adopted in another AP310i, different from the one I sent the initial config, but all the settings are the same as the first one, changing only a few range of IP and addresses, the same problem occurs in both units

[Matheus_Santana]

I have include the option in VLAN40 for test, even so, the users don’t get IP.

Here is the run config of one 7522 adopted in 310i:

!
! Configuration of AP7522 version 7.6.2.0-018R
!
!
version 2.7
!
!
ip snmp-access-list default
 permit any
!
firewall-policy default
 no ip dos tcp-sequence-past-window
 no stateful-packet-inspection-l2
 ip tcp adjust-mss 1400
!
!
mint-policy global-default
!
wlan-qos-policy default
 qos trust dscp
 qos trust wmm
!
radio-qos-policy default
!
aaa-policy RADIUS_FOGAS
 authentication server 1 host 191.1.10.3 secret 0 fogas123
 authentication server 1 proxy-mode through-controller
!
wlan Fogas_Corporativo
 description Fogas_Corporativo
 ssid Fogas_Corporativo
 vlan 1
 bridging-mode local
 encryption-type ccmp
 authentication-type eap
 no protected-mgmt-frames
 no radio-resource-measurement
 accounting radius
 data-rates 2.4GHz custom basic-12 basic-18 basic-24 basic-36 basic-48 basic-54 basic-mcs-1s mcs-2s
 data-rates 5GHz custom basic-12 basic-18 basic-24 basic-36 basic-48 basic-54 basic-mcs-1s mcs-2s
 use aaa-policy RADIUS_FOGAS
!
wlan Fogas_Mobile
 description Fogas_Mobile
 ssid Fogas_Mobile
 vlan 40
 bridging-mode tunnel
 encryption-type tkip-ccmp
 authentication-type none
 no protected-mgmt-frames
 wpa-wpa2 psk 0 Fogas@123
!
wlan Fogas_Visitante
 description Fogas_Visitante
 ssid Fogas_Visitante
 vlan 50
 bridging-mode tunnel
 encryption-type none
 authentication-type none
 no protected-mgmt-frames
!
auto-provisioning-policy APP-FOGAS-SJK
 adopt ap7522 precedence 1 profile AP-7522 rf-domain default ip 10.9.0.0/16
!
radius-server-policy default
 nas 191.1.10.3/32 secret 0 fogas123
!
dhcp-server-policy DHCP_FOGAS
 dhcp-pool vlan40
  network 192.168.49.0/24
  address range 192.168.49.10 192.168.49.254
  default-router 192.168.49.1
  dns-server  191.1.10.1 172.28.123.21
 dhcp-pool vlan50
  network 192.168.59.0/24
  address range 192.168.59.10 192.168.59.254
  default-router 192.168.59.1
  dns-server  192.168.59.1
!
!
management-policy default
 telnet
 no http server
 https server
 rest-server
 no ftp
 ssh
 user admin password 1 2be1cb418e8f64c2db772aee9ebcff7604d6fc945a6dfe02567e5cd50d01cc06 role superuser access all
 snmp-server community 0 private rw
 snmp-server community 0 public ro
 snmp-server user snmptrap v3 encrypted des auth md5 0 admin123
 snmp-server user snmpmanager v3 encrypted des auth md5 0 admin123
!
profile anyap AP-7522
 ip default-gateway 10.9.100.200
 ip route 192.168.49.0/24 192.168.49.1
 ip route 192.168.59.0/24 192.168.59.1
 no autoinstall configuration
 no autoinstall firmware
 use radius-server-policy default
 crypto ikev1 policy ikev1-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
 crypto ikev2 policy ikev2-default
  isakmp-proposal default encryption aes-256 group 2 hash sha
 crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
 crypto ikev1 remote-vpn
 crypto ikev2 remote-vpn
 crypto auto-ipsec-secure
 crypto load-management
 crypto remote-vpn-client
 interface radio1
  wlan Fogas_Corporativo bss 1 primary
  wlan Fogas_Visitante bss 2 primary
  wlan Fogas_Mobile bss 3 primary
  aggregation ampdu max-aggr-size tx 65535
  max-clients 512
  transmit-beamforming
 interface radio2
  wlan Fogas_Corporativo bss 1 primary
  wlan Fogas_Visitante bss 2 primary
  wlan Fogas_Mobile bss 3 primary
  max-clients 512
  transmit-beamforming
 interface ge1
  switchport mode trunk
  switchport trunk allowed vlan 1,40,50
 interface vlan1
  ip address dhcp
 interface pppoe1
 use dhcp-server-policy DHCP_FOGAS
 use firewall-policy default
 use auto-provisioning-policy APP-FOGAS-SJK
 controller host 10.9.5.1 pool 1 level 1
 service pm sys-restart
 router ospf
 adoption-mode controller
!
rf-domain default
 contact suporte@fogas.com.br
 timezone Etc/GMT-3
 country-code br
 ad-wips-wireless-mitigation disable
 ad-wips-wired-mitigation disable
!
ap7522 48-9B-D5-DA-22-2C
 use profile AP-7522
 use rf-domain default
 hostname AP-JSK-ADM03
 area Administracao
 floor Administracao
 ip default-gateway 10.9.100.200
 interface ge1
  switchport mode trunk
  switchport trunk allowed vlan 1,40,50
  switchport trunk native vlan 1
 interface vlan1
  ip address 10.9.5.3/16
 interface vlan40
  ip address dhcp
  ip dhcp client request options all

[ckelly]

Matheus,

It looks like the DHCP server configuration is correct on the AP310i.

Are the 7522’s being adopted to the VC 310i? (Are they getting their config?

On the 7522 Profile though, you need this configuration for the other two VLANs so that those SVI’s know to look for a DHCP server.

interface vlan40
  ip address dhcp
  ip dhcp client request options all

interface vlan50
  ip address dhcp
  ip dhcp client request options all