A few days ago seemingly with no changes (other than we changed the adsl mode on the controller). DHCP has stopped working for 2 of the 3 vlans we have configured on a Cisco 887VA.
From the Cisco there is a meraki switch, and two meraki AP's hanging off this switch. I can't currently confirm if a device directly connected to the 887 would get an IP correctly because the site is remote. However, devices are getting IP's from both the Lan pool, and the tablet pool, it's just wifi-guest that's acting up.
ip dhcp excluded-address 10.180.71.2 10.180.71.64 ip dhcp excluded-address 10.180.71.80 10.180.71.255 ! ip dhcp pool Lan network 10.180.71.0 255.255.255.0 default-router 10.180.71.1 dns-server 10.222.33.124 10.222.33.125 ! ip dhcp pool tablet network 10.5.1.0 255.255.255.0 default-router 10.5.1.1 dns-server 220.127.116.11 18.104.22.168 ! ip dhcp pool wifi-Guest network 192.168.223.0 255.255.255.0 default-router 192.168.223.1 dns-server 22.214.171.124 126.96.36.199 .... interface Vlan2 description "tablet" ip address 10.5.1.1 255.255.255.0 ip access-group tablet-lan-in in ip nat inside ip virtual-reassembly in interface Vlan5 description "Lan for Guest Wifi" ip address 192.168.223.1 255.255.255.0 ip access-group VLAN5-in in ip nat inside ip virtual-reassembly in ip tcp adjust-mss 1452 ip access-list extended VLAN5-in permit udp any host 192.168.223.1 eq bootps permit ip host 0.0.0.0 host 255.255.255.255 permit ip 192.168.223.0 0.0.0.255 192.168.233.0 0.0.0.255 deny ip 192.168.223.0 0.0.0.255 10.5.1.0 0.0.0.255 deny ip 192.168.223.0 0.0.0.255 10.180.70.0 0.0.1.255 permit ip any any ip access-list extended tablet-lan-in remark Allow DHCP Traffic in permit udp any host 10.5.1.1 eq bootps permit ip host 0.0.0.0 host 255.255.255.255 remark Allow tablet to internet but not to any private subnets permit tcp any any established permit ip 10.5.1.0 0.0.0.255 10.5.1.0 0.0.0.255 deny ip 10.5.1.0 0.0.0.255 10.0.0.0 0.255.255.255 deny ip 10.5.1.0 0.0.0.255 172.16.0.0 0.15.255.255 deny ip 10.5.1.0 0.0.0.255 192.168.0.0 0.0.255.255 permit ip 10.5.1.0 0.0.0.255 any
With all of this in place, I'm not seeing DHCP requests (or errors) for the 192.168.223.x subnet, when doing a debug. So my first question is should this access-list work to allow DHCP requests to reach the router? It seems to be working on other 887's we have, making me think there's maybe problem with this one.