H-REAP Issues: Clients get dropped onto Native VLAN on one AP

Question

Hi,
I have a wireless deployment consisting of 2 WLC's centrally located in two data centres, with WCS managing the WLC's.  There are currently two sites with wireless.  Each site is it's own AP Group with different SSIDs at both sites.
The site where I am having an issue with H-REAP has 48 AP's installed across a number of floors.
The problem I am experiencing is that when clients get associated to one specific AP, they will successfully connect to the SSID, but are getting dropped into the native VLAN (VLAN 23) instead of the VLAN (VLAN 22) that is mapped to the SSID.  The clients get an IP address from the native VLAN and can access the corporate network, but due to firewall rules they cannot get access to some key corporate assets, as the native VLAN (VLAN 23) is not included in a specific firewall group for wireless clients.  Clients connected to the same SSID but on a different AP are getting dropped into the correct VLAN (VLAN 22).
The switchport configuration for the one AP that is having issues is specifically below:
interface GigabitEthernet5/47
description *** Wireless AP ***
switchport access vlan 23
switchport trunk native vlan 23
switchport trunk allowed vlan 22,23
switchport mode trunk
spanning-tree portfast trunk
spanning-tree bpduguard enable
spanning-tree guard root
However, this configuration is the same across all AP connected switchports.  The switchport is trunking correctly:
show int gi5/47 trunk
Port        Mode             Encapsulation  Status        Native vlan
Gi5/47      on               802.1q         trunking      23
Port        Vlans allowed on trunk
Gi5/47      22-23
Port        Vlans allowed and active in management domain
Gi5/47      22-23
Port        Vlans in spanning tree forwarding state and not pruned
Gi5/47      22-23
I have attached a screenshot of the AP configuration from WCS.  As can be seen, the AP is configured for H-REAP, with the Native VLAN set, and the SSID-to-VLAN mappings also set.
I have tried doing a configuration reset on this AP and re-configuring it from scratch, but it still exhibits the same behaviour. 
Does anyone have any ideas on what I can do to resolve this problem?
Thanks in advance.

Answer 1

I have built an interface of the 2106 for VLAN5 and the interfaces for the 2106 and the bridges are built as trunks and all vlans are allowed. If I plug in a laptop on the 3560 in the new building, and the port is assigned to VLAN5, I get an address and can surf out just fine. I will scrub the 2106 & 3750 configs and try and upload them. To further test I moved the DHCP scope onto the 2106 and my wireless client is able to get an address from the 2106, I can ping the interface on the 2106 (192.168.5.2) I just cant connect to the 3750 switch.