Wlc5508 - dns answer packet is blocked

Question

/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Normale Tabelle";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-qformat:yes;
mso-style-parent:"";
mso-padding-alt:0cm 5.4pt 0cm 5.4pt;
mso-para-margin-top:0cm;
mso-para-margin-right:0cm;
mso-para-margin-bottom:auto;
mso-para-margin-left:0cm;
line-height:115%;
mso-pagination:widow-orphan;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-ascii-font-family:Calibri;
mso-ascii-theme-font:minor-latin;
mso-fareast-font-family:"Times New Roman";
mso-fareast-theme-font:minor-fareast;
mso-hansi-font-family:Calibri;
mso-hansi-theme-font:minor-latin;
mso-bidi-font-family:"Times New Roman";
mso-bidi-theme-font:minor-bidi;}
Hi,
I´ve changed  about 60 access points (1242/1231) from standalone-mode to controller-base – mode. We installed and configured three 5508 controllers with firmware-release AIR-CT5500-K9-7-0-98-0.aes. All of them have the same configuration.
We have different clients (Symbol, Dlog) with 802.1x LEAP and EAP-Fast Authentication in use. After authentication they connect to a web-based service that runs on a server on the campus.
After the change to controller-based we have the following problem:
When the clients wake up from sleep mode they authenticate correctly (Ping to the webserver is o.k.), but the login webpage can not be displayed (searching...). Then I`ve sniffered the uplink of the first controller to see what happend. I find out, that the DNS-Requests from the DNS-Server  do not achieve the wlan-clients and so the client tries to make the DNS-request  several times but without success. This problem occurs on all clients (handhelds, laptops...). To temporarily solve the problem I have to disable/enable the radio-interfaces of the clients.
Then I`ve changed the mode from local to HREAP on one AP and make a local break out at the AP and sniffered the uplink of the HREAP- AP. I´ve repeated the tests serveral times and with HREAP everything is working correctly. The clients get the DNS answer packets and the page is displayed immediately.
So why does the controller block the DNS-Requests after sleep-mode and reauthenticate of the clients ? With release AIR-CT5500-K9-6-0-196-0.aes the same problem occurs.
Thanks
Greeting Flo

Answer 1

Hi Flo,
I'd agree that the two client connections seem to be treated differently between the 4404 and the 5508.
From the 5508 debugs, the lines that got my attention are the following:
*Oct 07 11:36:21.304: 00:15:70:34:2a:b8 Orphan Packet from DS - IP 172.17.172.101
*Oct 07 11:36:22.742: 00:15:70:34:2a:b8 Installing Orphan Pkt IP address 172.17.172.101 for station
*Oct 07 11:36:22.742: 00:15:70:34:2a:b8 Assigning Address 172.17.172.101 to mobile
These seem to be the combination of two known defects.
1. CSCsq46427
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsq46427
Even if the symptoms are exactly the same as your case, this should be fixed in 7.0.98.0, until the next one was found.
2. CSCti83830
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCti83830
This second one should basically be a regression of CSCsq46427, specific for 5508 platforms.
To confirm whether you may be hitting such a situation, you could test one of the following options:
a) Apply the same workaround as for CSCsq46427.
b) Enable passive client support (only on 7.0):
http://www.cisco.com/en/US/docs/wireless/controller/7.0/configuration/guide/c70wlan.html#wp1391015
Should all of this still not be enough, I would then recommend to open a TAC case if more advanced troubleshooting is needed:
http://tools.cisco.com/ServiceRequestTool/create/
Regards,
Fede
If this answers your question please mark the question as "answered" and rate it, so other users can easily find it.