Case Study: STAs Fail to Go Online Because No IP Address Is Obtained Due to Traffic Filtering

Symptom

Some STAs fail to go online because they cannot obtain IP addresses.

Relevant Alarms and Logs

None

Cause Analysis

The traffic filtering configuration on the AC restricts the access to the network segment.

Procedure

1. Check the wireless connection on the native AC.
   1. Check the basic configurations.
      • Run the display vap-profile all command. The tunnel forwarding mode is used to forward wireless service data.
      • Run the display ip pool interface vlanif X command. An interface-based IP address pool is configured.
      • Run the display vlan X command. The VLAN status is normal.
   2. Use the trace and station-trace functions to check the DHCP process of the STA.

      # Use the station-trace function to check the STA packet forwarding process on the AP. The AP has forwarded DHCP Discover messages but has not received DHCP Offer messages.

      # Use the trace function to check the IP address allocation in the DHCP IP address pool on the gateway. The gateway has sent a DHCP Offer message to the STA.

2. Check the wired connection on the native AC.
   1. Configure bidirectional mirroring on the native AC in the direction to the AP.

      The result shows that the native AC does not respond to the DHCP Offer message.

   2. Check whether the switch does not send packets as expected due to policy restrictions.

      # Run the display current-configuration | include traffic command. The traffic-filtering policy is configured for the wireless service VLAN in the global configuration.

      # Run the display acl name xxxx command to check the ACL information. The access to some network segments is restricted.

3. In conclusion, the access control in a traffic policy prevents the STA from obtaining an IP address. You can resolve this exception by using either of the following methods:

   Method 1: Configure the ACL referenced by the traffic-filtering policy to permit the access to the related network segments.

   Method 2: Delete the traffic-filtering configuration.