DHCP scope in WLC.

hi all,
please any one confirm ,is it possible to configure the DHCP scope for APs in WLC ?
i am having 5508 controller connected to L3 switch..if it is possible what need to be done for that.
thanks in advance.
venkat

Hi Venkat,
WLC can lease IPs to APs only if we configure the pool in the same subnet as that of management interface.. having said that, its no possible to assign diff pool for AP which resides in diff subnet on the WLC.. We need to go for either Pool on the Layer 3 device or DHCP server.
IP MAC binding is already enabled on the WLC by default.. AFAIK, this is more usefull for PASSIVE clients rather to active
Lemme know if this answered ur question and please dont forget to rate the usefull posts
Regards
Surendra

Similar Messages

Monitoring DHCP scope on WLC 5508

Hi,
I have DHCP configured on the anchor controller but I don't know when DHCP scope is full on it. Do you have any idea or experience how to monitoring exhausted DHCP scope on WLC 5508?
Regarding

Ok but WLC can send syslog messages and base on this we can create an alarm. When DHCP scope is full on the WLC then controller inform us about this:
DHCP Server: Nov 13 11:34:56.321: %DHCP-3-SEND_OFFER_FAIL: dhcpd.c:278 Unable to send DHCP offer. Could not allocate appropriate ip address from the scope
*DHCP Server: Nov 13 11:34:56.321: %DHCP-4-ADDR_NOT_ALLOCATED: serverpacket.c:205 No IP addresses to give -- OFFER abandoned -- packet dropped
*DHCP Server: Nov 13 11:34:52.416: %DHCP-3-SEND_OFFER_FAIL: dhcpd.c:278 Unable to send DHCP offer. Could not allocate appropriate ip address from the scope
*DHCP Server: Nov 13 11:34:52.416: %DHCP-4-ADDR_NOT_ALLOCATED: serverpacket.c:205 No IP addresses to give -- OFFER abandoned -- packet dropped
so If only I could detect this sentence from the syslog messages than I could create an alarm.

Multiple DHCP scopes on WLC 5508 (not showing leases?)

I have 2 DHCP scopes set up on a wlc 5508, one for the AP's and another for a wlan, the leases for the AP's scope show up, but the one that the clients on the WLAN are on do not show up in the "show leases" is that a bug? normal?

Customers using Cisco Unified Wireless solutions have been reporting issues with the DHCP support provided on the Wireless LAN Controller (WLC). Some of these issues are software bugs or debugability problems. Others are due to lack of proper understanding on the DHCP implementation.
This document describes the different DHCP operations on the wireless controller, which provides consistent and accurate information to customers in an effort to reduce the related customer issues and TAC cases.
Please refer to the following link: http://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/110865-dhcp-wlc.html

Internal DHCP scope for AP on WLC 7.0 (on diff subnet)

hi All,
I would like to know if it is possible to assign dhcp pool on a different subnet to the WLC management interface?
Eg: Management Interface is on 172.16.4.100 /24
I would like to use the WLC Internal DHCP to assign IP to my APs on the a different range 172.16.2.x /24
Is that possible?
I have tried assigning dhcp scope for the AP within the same subnet as the management interface and it works. But that is not my requirement
Apparently i need my AP to be sitting on a different vlan
please advise

No its not possible.. this works only if the AP and the WLC management interface is in the same subnet!! to ur issue we use something called as DHCP OPTION 43, google search DHCP OPTION 43 + cisco, the first link that u get wil help you!!
Please dont forget to rate the usefull posts!!
Regards
Surendra

DHCP scope increase and changes in wlc

hi,
i am using wlc 4402 with a mgt ip 172.26.150.x/24 and ap manager ip 172.26.150.x/24, my all ap get the ip address from dhcp . currently in dhcp server 172.26.150.3 to 254 dhcp scope is configured. at mysite some devices are configured like ipad,iphone or galaxy tab with mac binding in dhcp server. now this pool is almost full. i have a policy configured for these devices for mac binding is done in DHCP. to increase pool what are the changes i need to do in wlc. what are the changes i need to do in dhcp server . is policy made for mac binding in dhcp server will get affected by this ?
regards
rajat

Hi Rajat,
Use a /23 range ip address rather than using 172.26.150.x/24. So at first this change need to be carried out on the L3 device (which will the default gateway of the WLC managment interface). Accordingly the AP managment ip and ap manager ip's subnet mask is going to change from /24 to /23.
Then ensure that on the dhcp server you expand the scope from /24 to /23. This is will not affect the MAC bindings as long as you are using the same ip range with a different subnet mask.
Hope that helps
Regards
Najaf
Please rate when applicable or helpful !!!

WLC dhcp scope issue

Hi,
We are facing this problem
we are using guest SSID with captive portal authentication.
We are using below step to conect to network
1) User will click on guest SSID & get IP from DHCP scope
2) User will open google.com & then it will redirect to authentication page - we need to provide userid/pass & then we will able to access internet
Problem
Assume user only do Step -1 , Then My dhcp scope is utilizing
How can we restrict the same to 'geneuine' user, any option/workaround ?
br/subhojit

I have to agree with e. Shortening theeaae will help.
But the kny way to keep people off the WLAN would be to use a PSK so that only authorized users can get on.
HTH
Steve

Client Authentication/Authorization via ISE & AD, Posture Registry Key, and mapped to specific DHCP scope by AD membership

Hi Team,
I'm currently working on a configuration entailing WLC and ISE where the customer wants a single SSID,and wants his wireless clients to authenticate successfully if they pass a registry key compliance. Additionally, they want clients to received a different IP address or get mapped to a different DHCP scope based on the Microsoft AD group they belong too. for example:
Client authenticating with registry key and in AD group ABC that passes authentication gets IP address or subnet for AD group ABC.
Client authenticating with registry key and in AD group XXX that passes authentication gets IP address or subnet for AD group XXX.
Clients---->WLC------>ISE-----> MS AD ( groups ABC, XXXX, YYY )
currently using EAP-PEAP/MSCHAPv2
Does anyone have any idea or pointers or can refer me somewhere that I can read on how to accomplish this? Not sure on how to do the registry compliance check nor what attributes will allow me to map the client to a DHCP Scope based on this AD group membership?
Thanks...

Do check cisco how to guides you will get step by step configuration of the current requirement

Is there a way for internal DHCP Scope to release scope addresses when the wifi client has disconnected?

DHCP scope is configured on a WLC 5508.
I'm checking if there' a way for WLC to clear the dhcp leasing when a user is diconnected from wireless?

Unless the client sends a DHCP Release upon disconnect, which is not mandaded in the protocol, the lease will simply remain until it has expired. If you're concerned with running out of leases, you only have 2 options.
1. reduce the lease time of your dhcp scope
2. increase the network size to accomodate more usable addresses.
There isn't a way to force a DHCP address lease to be "cleared" from the WLC simply because the client was disconnected.

How DHCP scope will work between two Wireless contoller

Dear All,
I would like to inform you that we are going to deploy Wireless Network with redundancy of Wireless LAN Controller and we need to figure out how DHCP scope would work during fail over any one of Wireless LAN controller and DHCP Server .I have two site where Two Differenet DHCP Server would be palced with different DHCP socpe.So My query is that if Site-A(according to attached diagram) DHCP Server and controller fails how Wireless client will take the DHCP scope from Site-B(according to attached diagram) DHCP Server as it has been configured different DHCP Scope.Can any one tell me whether i can configure same DHCP Scope at Both Site's DHCP Server.
Is there any way to configure same DHCP Scope for two sites.For your infromation client wants two Different DHCP Server with different scope for Two Site and how redundancy would be ensured if any one WLC or DHCP goes down.
I am eagerly waiting for your reply as early as possible.Please help to figure out the solution.
I am going to attached Sample Design for your reference.
Thanks and regards
Erfan

Erfan:
My query was that if one wireless client already associated
WLC-A with one IP block of Location-A (DHCP Server) using SSID named TEST. If DHCP-A or WLC-A goes down then how that same client would associate with WLC-B and get the IP Block from Location-B (DHCP Server) using same SSID name TEST.
In this case the clinets connected to the APs in location A will disconnect (if the WLC went down) and they have to connect again when the APs join WLC-B. They will get IP address from location B block then.
If DHCP went down when new clinets try to connect the primary DHCP is down so they are referred to the secondary DHCP. connected clinets will disconnect only when their DHCP lease times out. They will try to renew but the DHCP server is not available. They will disconnect then and connect again and getting IP from B site.
1. How we will create same policy for that two different block using same SSID.
what policy? where?..etc?
2. client would be connected with Access point but they will get the IP through VLAN interface of the Controller and we have to assign IP helper address in the interface vlan.So how the the client would get the IP block if we assign two IP helper address in the interface vlan in case of failure of DHCP and WLC of one location.
3. If we assign two IP helper address then which DHCP Server will release the IP for client and we can make delay between two DHCP Server to release the IP address.
If two IP helpers are configured the switch will send them both the client's request and they client receives two offers. The clients chooses one of the offers. Usually the clinet will accept the faster DHCP server to respond.
If you are using the DHCP on the WLC then it is different. The WLC will always try to reach the primary DHCP server as long as it is reachable. If the primary DHCP is not reachable then it falls back to the secondary DHCP server.
Note that when you use IP helper then you usually disable DHCP Proxy feature on the controller. Do you have it disabled?

ASA Migration of DHCP Scope to a Server

Hello All,
We migrated the DHCP scope from the ASA to a MS DHCP server with this configuration:
group-policy BV-SSL1 internal
group-policy BV-SSL1 attributes
no address-pools value remotepool4 remotepool2 remotepool3
no intercept-dhcp enable
dhcp-network-scope 10.180.49.0
exit
tunnel-group BVVPN10 general-attributes
no address-pool remotepool2
no address-pool remotepool3
no address-pool remotepool4
dhcp-server 10.182.14.55
exit
tunnel-group BV-SSL general-attributes
no address-pool remotepool2
no address-pool remotepool3
no address-pool remotepool4
dhcp-server 10.182.14.55
exit
no vpn-addr-assign aaa
no vpn-addr-assign local
vpn-addr-assign dhcp
This is running good, until we used all 254 addresses that was specified in the dhcp-network-scope.
My question is should i have specified dhcp-network-scope none to allow for all 3 scopes can be used to hand out IP addresses for the remote users?
Thanks,
Kimberly

Okay, that's at least a good start. Can you monitor the ULS logs while you attempt to browse to the site to see what form of error(s) you're getting?
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Windows 2008 R2 DHCP scope change - Netsh Exec not working

OK, there seems to be a disconnect between Netsh documentation and how it actually works. We are in the process of re-addressing ALL our DHCP scopes (joys of a buy-out) and using the steps outlined in numerous MS articles and Blogs etc... we should
be able to use "Netsh dhcp server scope 192.168.1.0 dump > scope1.cfg" then modify the cfg file with the new scope address (i.e. change all 192.168.1. to lets say 10.10.5.). Then use netsh exec scope1.cfg (yes, the file modified) to
create the new scope which would contain all the "stuff" the current scope has (reservations, options, etc).
Well, all we get is the response "The following command was not found: |".
Environment is as follows:
Account is a domain admin
working on a RDP session on the DHCP server
Server is Windows 2008 R2 (current functioning DHCP server)
Using administrative CMD (elevated)
have tried changing context into Netsh | DHCP | Server and default CMD - all "no go"
supporting link from MS: http://technet.microsoft.com/en-us/library/cc772372(v=ws.10).aspx#BKMK_1
There's a lot of discussions around this, but I haven't seen any response that says how to actually do it. export/import won't work for us since we have to update the scope info. With almost 100 scopes to update, we really need this functionality!
(or similar method)
Any assistance would be greatly appreciated.

OK... It seems the issue is with the dump file. I actually got exec to run once with a dump file which wasn't modified.  The stupid part is it only ran one time, I could not duplicate it.   Since
I've beat this thing to death and no one could offer any assistance (Hello MS?), I'm not wasting any more time on it.   Luckily, I was able to figure out an alternate method.
Looking at the dump file I realized all the lines are just a straight NetSh commands, which means all I needed to do is grab the lines and preface them with NetSh. Like this...
for /f "tokens=*" %a in ('type scope.cfg ^| find /i "dhcp"') do NetSh %a
where scope.cfg is your dump file.   This runs perfect and seems to be the exact thing that exec should be doing. I did flip the "SET STATE 1" to "0" so the scope was deactivated (Don't forget to run it in an elevated
prompt).
Hope this helps someone else so they aren't spending days for nothing!

Ip source guard feature and dhcp DHCP scope exhaustion (client spoofs other clients)

Hi everybody.
A dhcp server assigns ip adress based on mac address carried by client hardware field in dhcp packets.
One potential attack is when a rogue host mimics different mac addresses and causes dhcp server to assign the ip addresses until no ip address is left for legitimate host.
For e.g a host h1 with mac1 has assigned ip address by dhcp server as:
199.199.199.1 mac1
Dhcp server has the above entry in its database.
Using hacking tools such as Yersinia or Gobbler one can create a dhcp discover messages each time creating a different mac for client hardware field in dhcp server thereby causing a dhcp server to assign ip addresses because to dhcp server , these are legitimate dhcp discover messages with each carrying a different mac in client hardware addresses.
You might say use dhcp snooping and it will prevent that ( dhcp scope exhaustion) and configure the switch to check if src mac matches the client hardware address in dhcp message. But still we can creat spoofed discover messages where src mac in ethernet header will match the client hardware address in dhcp discover message. We still did not overcome the problem.
You might say use IP source guard feature but will it really prevent that problem from happening?
Let me illustrate it :
h1---------f1/1SW---------DHCP server
Let say we have configured dhcp snooping on sw1 and f1/1 is untrusted port. The switch has following dhcp binding
199.199.199.1    mac1   vlan1 f1/1
Next we configure ip source guard to validate both src mac and src ip against the dhcp bindings . When we configures ip source guard first , it will allow dhcp communication only so a host can request ip address and a dhcp binding can be built. After that ip source guard will validate src ip or src mac or both against the dhcp binding.depending upon how we configure ip source guard.
In our case we have configured ip source guard to validate both src mac and src ip against the dhcp binding.
A dhcp binding is already created as:
199.199.199.1 mac1 vlan 1 f1/1
Now using the hacking tools Yersinia or Gobbler on h1, we create our first spoofed dhcp discover message where src mac=mac2 in ethernet header and client harware address= mac2 in dhcp discover message. Since switch is configured with ip source guard feature and therefore allows dhcp discover message to pass through. Dhcp server upon receiving the dhcp message assigns another ip address from the pool. Now the dhcp server has following entries:
199.199.199.1 mac1
199.199.199.2 mac2.
We can continue to craft spoofed dhcp discover messages as mentioned above and have dhcp server keep assigning ip addresses until the whole pool is exhausted.
So my question is how does ip source guard in conjuction with dhcp snooping prevent this particular attack from happening? ( i.e DHCP scope exhaustion)
I really appreciate your input.
thanks and have a great week.

Thanks Karthikeyan.
First of all, we gather all the information about the locations of legitimate dhcp servers in our network. Once we have this information, we will configure the ports used to reach them as trusted. All the ports where end users will connect will be untrusted and therefore subject to dhcp snooping .
it means if any of user connected in that switch/vlan runs a dhcp services like vmware for eg. Snooping will prevent the dhcp/bootp servers connected to that port will not be able to process.
Yes that is correct. Because dhcp snooping feature will check these ports for the messages usually sent by dhcp server such as dhcp offer, etc. If the end user is running dhcp server using virtual machine, that port should be configured as trusted if it is dertermined that end user is running a legitimate dhcp server using vm ware.
When we have the dhcp snooping it prevents the 1st level of hacking itself. I don't think so it will have any impact on dhcp address releasing.
I am sorry. You lost me here. What is 1 level of hacking?
Dhcp snooping checks for dhcp messages such as dhcp release, dhcp decline.on untrusted port against the dhcp bindings.
Here is why;
h1---------SW1-------dhcp server
               |
             h2
Let say we don't have dhcp snooping in above attack and h2 is a legitimate user has already assigned ip address 199.199.199.2 by dhcp server. Thus the dhcp server has an entry:
199.199.199.2 mac2
Next we connect rogue user and it gets ip address 199.199.199.1 now the dhcp server has entries:
199.199.199. 1 mac1
199.199.199.2   mac2
Now using hacking tools, h1 create a fake dhcp release message with 199.199.199.199.2   mac2
Dhcp server upon receiving this message, will release the ip address and returns it to the pool.
By using DHCP snooping, switch will peer inside dhcp release message and checks against the binding. If there is conflict, it will drop the message.
IFor e.g
If have dhcp snooping configured , then switch will have adhcp binding as:
199.199.199.1    mac1    vlan 1   f1/1 lease time
199.199.199.2     mac2    vlan 2    f1/2 lease time.
If h1 tries to send fake dhcp release with ip address 199.199.199.2    mac2
Switch will check ip address 199.199.199.2 and mac2 against the binding related to f1/1 . Sw will find a conflict and therefore drops the dhcp release packet.
Thanks

Multiple Lease Duration for one DHCP Scope?

Hi All,
I have an urgent question. I wanted to know if it is possible to have many lease durations for different computer groups getting their addresses from one DHCP scope. I saw somewhere that it is possible to use User Classs or Vendor Classes for setting a lease
duration for a group of computers sharing the same class Id ?
If it is true, How can to configure ?
Also i would like to know about the lease duration period what is the maximum days can we have ( 8 days After )?
Thanks
Atul

Please refer to the following-
http://social.technet.microsoft.com/Forums/windowsserver/en-US/26de79f9-6ad7-4088-9077-006b9dd8c1fb/multiple-lease-durations-for-one-dhcp-scope?forum=winserveripamdhcpdns
You can configure any value as lease duration; however if you want a very big/infinite value; it makes sense to convert the lease(s) to a reservation.

Best place to create the DHCP scope for Guest SSID for remote office connected to HQ Foreign-Anchor controller

Hi Experts ,
Need help with the respect to understand the best practice to place/create the DHCP scope for remote site Guest SSID which will be connected to HQ Foeign-Anchor controller set-up.
how about internet traffic for Guest SSID , which one will be recommanded :
1) Guest SSID gets authenticated from HQ ISE and exposed to the local internet
2) Guest SSID gets authenticated from HQ ISE and exposed to the HQ internet
Thanks

Hi George ,
Thanks for your reply ...So you mean, best design would be to create the DHCP scope into DMZ for guest and let it get exposed to HQ internet ...
how about if I have another anchor controller in lets say in other office and I need to anchor the traffic or load balance from HQ foreign controller , in that case if I create DHCP scope into HQ anchor controller and if its down , I will loose the connectivity , how do I achieve fail-over to another anchor ?
Do I need to create secondary scope into another anchor controller and let the client get reauthenticated from other location ISE and get ip address as well from another anchor controller . Is it what you are proposing ?

How to check particular DHCP Scope all Details.

How to check particular one DHCP Scope ALL Details. Server is Windows 2003 so Powershell.
Any Command like Netsh or anything? For a particular Scope.
Also How to export & import a particular DHCP Scope?
AliahMurfy

Hi,
With netsh command you can manage your DHCP server.
For more information you can refer to:
Netsh commands for DHCP
http://technet.microsoft.com/en-us/library/cc787375.aspx#BKMK_export
Especially for subtitle Netsh DHCP server
Hope this helps.

DHCP scope in WLC.

Similar Messages

Maybe you are looking for