1

A few days ago seemingly with no changes (other than we changed the adsl mode on the controller). DHCP has stopped working for 2 of the 3 vlans we have configured on a Cisco 887VA.

From the Cisco there is a meraki switch, and two meraki AP's hanging off this switch. I can't currently confirm if a device directly connected to the 887 would get an IP correctly because the site is remote. However, devices are getting IP's from both the Lan pool, and the tablet pool, it's just wifi-guest that's acting up.

ip dhcp excluded-address 10.180.71.2 10.180.71.64
ip dhcp excluded-address 10.180.71.80 10.180.71.255
!
ip dhcp pool Lan
 network 10.180.71.0 255.255.255.0
 default-router 10.180.71.1 
 dns-server 10.222.33.124 10.222.33.125 
!
ip dhcp pool tablet
 network 10.5.1.0 255.255.255.0
 default-router 10.5.1.1 
 dns-server 8.8.8.8 8.8.4.4 
!
ip dhcp pool wifi-Guest
 network 192.168.223.0 255.255.255.0
 default-router 192.168.223.1 
 dns-server 8.8.8.8 8.8.4.4

....

interface Vlan2
 description "tablet"
 ip address 10.5.1.1 255.255.255.0
 ip access-group tablet-lan-in in
 ip nat inside
 ip virtual-reassembly in    

interface Vlan5
 description "Lan for Guest Wifi"
 ip address 192.168.223.1 255.255.255.0
 ip access-group VLAN5-in in
 ip nat inside
 ip virtual-reassembly in
 ip tcp adjust-mss 1452

ip access-list extended VLAN5-in
 permit udp any host 192.168.223.1 eq bootps
 permit ip host 0.0.0.0 host 255.255.255.255
 permit ip 192.168.223.0 0.0.0.255 192.168.233.0 0.0.0.255
 deny   ip 192.168.223.0 0.0.0.255 10.5.1.0 0.0.0.255
 deny   ip 192.168.223.0 0.0.0.255 10.180.70.0 0.0.1.255
 permit ip any any

ip access-list extended tablet-lan-in
 remark Allow DHCP Traffic in
 permit udp any host 10.5.1.1 eq bootps
 permit ip host 0.0.0.0 host 255.255.255.255
 remark Allow tablet to internet but not to any private subnets 
 permit tcp any any established
 permit ip 10.5.1.0 0.0.0.255 10.5.1.0 0.0.0.255
 deny   ip 10.5.1.0 0.0.0.255 10.0.0.0 0.255.255.255
 deny   ip 10.5.1.0 0.0.0.255 172.16.0.0 0.15.255.255
 deny   ip 10.5.1.0 0.0.0.255 192.168.0.0 0.0.255.255
 permit ip 10.5.1.0 0.0.0.255 any

With all of this in place, I'm not seeing DHCP requests (or errors) for the 192.168.223.x subnet, when doing a debug. So my first question is should this access-list work to allow DHCP requests to reach the router? It seems to be working on other 887's we have, making me think there's maybe problem with this one.

2
  • How bout removing the access-list from Vlan5 and test if that is problem? – user36472 Mar 8 '19 at 18:35
  • 1
    I see you found the problem in chat, please add an answer yourself. :-) – user36472 Mar 8 '19 at 18:41
1

Annoyingly (~8 hours later!) I've noticed that while the router can talk to the AP's and vice versa, the meraki dashboard is showing the uplink isn't in fact a cisco, and is a ubiquiti switch instead.

It appears the client has put an extra switch in, which is only passing on DHCP for the native vlan.

4
  • Please accept your own answer whenever it's possible. – user36472 Mar 9 '19 at 16:09
  • 1
    Will do, in 22 hours ;) – djsmiley2kStaysInside Mar 9 '19 at 17:33
  • 1
    Think it's time now to accept it :D – user36472 Mar 13 '19 at 14:04
  • Thanks for the reminder :D – djsmiley2kStaysInside Mar 13 '19 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.