DHCP Server functionallity with 310i as VC

[Matheus_Santana]

Hello, 

I have an AP310i as a VC in a site, where it adopts APs 7522. In addition to the native VLAN 1, I need to deliver IP to two other different VLANs, for that, I created DHCP servers in the controller. This configuration is identical to another site, where I have an RFS6000 as controller, and everything is working correctly, however, with the 310i as VC, the adopted APs do not deliver IP through this DHCP Server.

Here is the running config of AP310i (VC):

!
! Configuration of AP310 version 7.6.2.0-018R
!
!
version 2.7
!
!
client-identity-group default
 load default-fingerprints
!
ip access-list BROADCAST-MULTICAST-CONTROL
 permit tcp any any rule-precedence 10 rule-description "permit all TCP traffic"
 permit udp any eq 67 any eq dhcpc rule-precedence 11 rule-description "permit DHCP replies"
 deny udp any range 137 138 any range 137 138 rule-precedence 20 rule-description "deny windows netbios"
 deny ip any 224.0.0.0/4 rule-precedence 21 rule-description "deny IP multicast"
 deny ip any host 255.255.255.255 rule-precedence 22 rule-description "deny IP local broadcast"
 permit ip any any rule-precedence 100 rule-description "permit all IP traffic"
!
mac access-list PERMIT-ARP-AND-IPv4
 permit any any type ip rule-precedence 10 rule-description "permit all IPv4 traffic"
 permit any any type arp rule-precedence 20 rule-description "permit all ARP traffic"
!
ip snmp-access-list default
 permit any
!
firewall-policy default
 no ip dos tcp-sequence-past-window
 no stateful-packet-inspection-l2
 ip tcp adjust-mss 1400
!
!
mint-policy global-default
!
meshpoint-qos-policy default
!
wlan-qos-policy default
 qos trust dscp
 qos trust wmm
!
radio-qos-policy default
!
aaa-policy RADIUS_FOGAS
 authentication server 1 host 191.1.10.3 secret 0 fogas123
 authentication server 1 proxy-mode through-controller
!
wlan Fogas_Corporativo
 description Fogas_Corporativo
 ssid Fogas_Corporativo
 vlan 1
 bridging-mode local
 encryption-type ccmp
 authentication-type eap
 no multi-band-operation
 use aaa-policy RADIUS_FOGAS
!
wlan Fogas_Mobile
 description Fogas_Mobile
 ssid Fogas_Mobile
 vlan 40
 bridging-mode tunnel
 encryption-type tkip-ccmp
 authentication-type none
 no multi-band-operation
 no protected-mgmt-frames
 wpa-wpa2 psk 0 Fogas@123
!
wlan Fogas_Visitante
 description Fogas_Visitante
 ssid Fogas_Visitante
 vlan 50
 bridging-mode tunnel
 encryption-type none
 authentication-type none
 no multi-band-operation
 no protected-mgmt-frames
 time-based-access days all start 06:00 end 19:00
!
smart-rf-policy default
 no select-shutdown
 no smart-sensor
 smart-sensor auto-trigger
 smart-sensor band smart-band-5GHz
 smart-sensor tri-radio-only
!
auto-provisioning-policy APP-FOGAS
 adopt ap7522 precedence 1 profile AP-7522 rf-domain default ip 10.8.0.0/16 
!
radius-server-policy default
 nas 191.1.10.3/32 secret 0 fogas123
!
dhcp-server-policy DHCP_FOGAS
 bootp ignore
 dhcp-pool vlan40
  network 192.168.48.0/24
  address range 192.168.48.10 192.168.48.254 
  default-router 192.168.48.1
  dns-server  191.1.10.1 172.28.123.21
 dhcp-pool vlan50
  network 192.168.58.0/24
  address range 192.168.58.10 192.168.58.99 
  default-router 192.168.58.1
  dns-server  8.8.8.8 8.8.4.4
!
!
management-policy default
 telnet
 no http server
 https server
 rest-server
 ssh
 user admin password 1 8553661a49b0c8a0856a3ee27bfc63a1a5a14b39861bdb89af85a547fbb8d899 role superuser access all
 snmp-server community 0 private rw
 snmp-server community 0 public ro
 snmp-server user snmptrap v3 encrypted des auth md5 0 admin123
 snmp-server user snmpmanager v3 encrypted des auth md5 0 admin123
!
event-system-policy default
!
profile anyap AP-7522
 ip default-gateway 10.8.100.200
 no autoinstall configuration
 no autoinstall firmware
 crypto ikev1 policy ikev1-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ikev2 policy ikev2-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
 crypto ikev1 remote-vpn
 crypto ikev2 remote-vpn
 crypto auto-ipsec-secure
 crypto load-management
 crypto remote-vpn-client
 interface radio1
  wlan Fogas_Corporativo bss 1 primary
  wlan Fogas_Visitante bss 2 primary
  wlan Fogas_Mobile bss 3 primary
 interface radio2
  wlan Fogas_Corporativo bss 1 primary
  wlan Fogas_Visitante bss 2 primary
  wlan Fogas_Mobile bss 3 primary
 interface radio3
 interface bluetooth1
  shutdown
  mode bt-sensor
 interface up1
  switchport mode trunk
  switchport trunk allowed vlan 1,40,50
 interface eth0
 interface eth1
 interface eth2
 interface eth3
 interface ge1
  switchport mode trunk
  switchport trunk allowed vlan 1,40,50
 interface ge2
 interface fe1
 interface fe2
 interface fe3
 interface fe4
 interface vlan1
  ip address dhcp
 interface pppoe1
 use dhcp-server-policy DHCP_FOGAS
 use firewall-policy default
 use auto-provisioning-policy APP-FOGAS
 service pm sys-restart
 router ospf
 adoption-mode controller
!
profile ap310 default-ap310
 ip name-server 191.1.10.1
 ip name-server 191.1.10.3
 ip name-server 172.28.123.21
 ip domain-name fogas.local
 ip default-gateway 10.8.100.200
 autoinstall configuration
 autoinstall firmware
 crypto ikev1 policy ikev1-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ikev2 policy ikev2-default 
  isakmp-proposal default encryption aes-256 group 2 hash sha 
 crypto ipsec transform-set default esp-aes-256 esp-sha-hmac
 crypto ikev1 remote-vpn
 crypto ikev2 remote-vpn
 crypto auto-ipsec-secure
 crypto load-management
 crypto remote-vpn-client
 interface radio1
  wlan Fogas_Corporativo bss 1 primary
  wlan Fogas_Mobile bss 2 primary
  wlan Fogas_Visitante bss 3 primary
  antenna-mode 2x2
 interface radio2
  wlan Fogas_Corporativo bss 1 primary
  wlan Fogas_Mobile bss 2 primary
  wlan Fogas_Visitante bss 3 primary
  antenna-mode 2x2
 interface bluetooth1
  shutdown
  mode le-sensor
 interface ge1
  description "Vlan Rede Local"
 interface ge2
  description "Vlan Rede Sem Fio"
 interface vlan1
  ip address dhcp
  ip dhcp client request options all
 interface pppoe1
 interface usb0
 use dhcp-server-policy DHCP_FOGAS
 no use firewall-policy
 ntp server a.ntp.br 
 use client-identity-group default
 no virtual-controller management-interface ip address
 logging on
 service pm sys-restart
 router ospf
 adoption-mode controller
!
rf-domain default
 location Cuiaba
 contact suporte@fogas.com.br
 timezone Etc/GMT-4
 country-code br
 ad-wips-wireless-mitigation disable
 ad-wips-wired-mitigation disable
!
ap7522 94-9B-2C-2A-DB-AC
 use profile AP-7522
 use rf-domain default
 hostname AP-CGB02-ADM01
 area Administracao
 floor Administracao
 interface vlan1
  ip address 10.8.5.1/16
  ip address zeroconf secondary
!
ap310 20-9E-F7-78-F5-91
 use profile default-ap310
 use rf-domain default
 hostname AP-CGB-ADM01
 area CONTROLLER
 use radius-server-policy default
 interface radio1
  wlan Fogas_Corporativo bss 1 primary
  wlan Fogas_Visitante bss 2 primary
  wlan Fogas_Mobile bss 3 primary
  ldpc
 interface radio2
  wlan Fogas_Visitante bss 1 primary
  wlan Fogas_Mobile bss 2 primary
  wlan Fogas_Corporativo bss 3 primary
  ldpc
 interface ge2
  switchport mode trunk
  switchport trunk allowed vlan 1,40,50
  switchport trunk native vlan 1
 interface vlan1
  ip address 10.8.5.2/16
  ip address zeroconf secondary
 interface vlan40
  ip address 192.168.48.3/24
 interface vlan50
  ip address 192.168.58.3/24
 use dhcp-server-policy DHCP_FOGAS
 no use auto-provisioning-policy
 virtual-controller
 rf-domain-manager capable
 no adoption-mode
!
!
end

[Matheus_Santana]

From port 68 to 67 I got this:

10 17:04:47.831224 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 306, DHCP Discover from 8C-45-00-83-6A-BC, DF, DSCP 4
11 17:04:49.917764 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 306, DHCP Discover from 8C-45-00-83-6A-BC, DF, DSCP 4
12 17:04:50.573403 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 310, DHCP Discover from A4-63-A1-58-EE-12 for 192.168.59.251, DSCP 0
13 17:04:52.599713 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 320, DHCP Discover from 52-6F-8E-CF-9F-4B, DF, DSCP 4
14 17:04:52.739498 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
15 17:04:53.620045 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 320, DHCP Discover from 52-6F-8E-CF-9F-4B, DF, DSCP 4
16 17:04:53.761857 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
17 17:04:54.163434 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 306, DHCP Discover from 8C-45-00-83-6A-BC, DF, DSCP 4
18 17:04:54.399734 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 310, DHCP Discover from A4-63-A1-58-EE-12 for 192.168.59.251, DSCP 0
19 17:04:54.760749 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 312, DHCP Discover from A8-DB-03-EE-31-2A, DF, DSCP 4
20 17:04:55.447080 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 294, DHCP Discover from 0E-05-F7-27-D0-2A, DF, DSCP 4
21 17:04:55.560933 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 320, DHCP Discover from 52-6F-8E-CF-9F-4B, DF, DSCP 4
22 17:04:55.687330 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
23 17:04:59.383870 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 310, DHCP Discover from A4-63-A1-58-EE-12 for 192.168.59.251, DSCP 0
 

And 67 to 68:

10 17:05:42.188657 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 294, DHCP Discover from 0E-05-F7-27-D0-2A, DF, DSCP 4
11 17:05:42.902674 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from 36-3B-4C-2E-A5-8D, DF, DSCP 4
12 17:05:43.199825 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
13 17:05:44.307935 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
14 17:05:44.899103 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from 36-3B-4C-2E-A5-8D, DF, DSCP 4
15 17:05:45.573458 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 320, DHCP Discover from 52-6F-8E-CF-9F-4B, DF, DSCP 4
16 17:05:46.263094 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
17 17:05:47.750456 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 308, DHCP Discover from 70-FD-46-55-B4-20, DF, DSCP 4
18 17:05:48.656315 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from 36-3B-4C-2E-A5-8D, DF, DSCP 4
19 17:05:50.102281 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from CA-35-9C-07-10-BE, DF, DSCP 4
20 17:05:50.433774 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 294, DHCP Discover from 0E-05-F7-27-D0-2A, DF, DSCP 4
21 17:05:53.407806 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 320, DHCP Discover from 52-6F-8E-CF-9F-4B, DF, DSCP 4
22 17:05:55.215486 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 308, DHCP Request from 98-CA-33-91-12-86 to 0.0.0.0 for 192.168.59.234/0.0.0.0, DSCP 0
23 17:05:56.527166 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 300, DHCP Discover from 30-FC-EB-75-83-0F, DF, DSCP 4
24 17:05:56.993740 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 296, DHCP Discover from 36-3B-4C-2E-A5-8D, DF, DSCP 4
25 17:05:57.022513 UDP: 0.0.0.0 > 255.255.255.255 ports 68 > 67, data length 308, DHCP Request from 98-CA-33-91-12-86 to 0.0.0.0 for 192.168.59.234/0.0.0.0, DSCP 0
 

[ckelly · Accepted solution]

From the CLI of one of the 7522’s, try running this:

enable

service pktcap on bridge filter port 67 and port 68

The output will show the actual DHCP traffic bridging through the AP. My guess is that either the OFFER is not making it back or the client’s REQUEST isn’t going out.

[Matheus_Santana]

Understood, currently I've changed it to local, in both VLANs, in addition, I also disabled the DHCP service directly in the profile of the APs 7522, leaving only the 310i. Despite this, clients still don't get IP from the 7522 APs.

[ckelly]

For reference, this is what I’m talking about, regarding the tunneling option of the wlan:

wlan Fogas_Visitante
 description Fogas_Visitante
 ssid Fogas_Visitante
 vlan 50
 bridging-mode tunnel
 encryption-type none
 authentication-type none
 no protected-mgmt-frames

It sounds like maybe you are not familiar with this bridging mode. To be clear, a tunneled wlan like this will force the wireless client’s traffic to be carried over a MiNT tunnel to another MiNT capable device - normally the WiNG controller, where it is then unpacked and dropped onto the proper VLAN that exist on the controller’s interface. In this case, the controller is the AP310i VC.

A “local” bridged wlan will simply take wireless client traffic and bridge it directly onto the assigned VLAN on the APs ge1/ge2 interface, where it then makes its way to the switch and is then treated like normal LAN traffic.

The problem here is that a VC AP does not support a data plane, which is what is needed to be able to process the wireless client traffic coming back via the MiNT tunnel. So when using an AP as a VC, all of your wlans MUST be configured for “local” bridging mode.