Clients get IP in management VLAN

  • 1
  • Question
  • Updated 3 years ago
  • Answered

Hi


Stumbled upon a strange issue ...

Some of our clients are getting an IP in the management VLAN (VLAN10) of our AP's

We have about 185 AP121's (all untagged in VLAN10) and we're using 802.1x to assign different VLAN's to our users (depending on their group membership).

HOWEVER VLAN 10 is not assigned to any user(s) ...

Any ideas?



thanks!

Photo of Kevin Baert

Kevin Baert

  • 28 Posts
  • 1 Reply Like

Posted 3 years ago

  • 1
Photo of Hans Matthé

Hans Matthé

  • 131 Posts
  • 28 Reply Likes

Hi Kevin

I assume that the AP's are connected to a trunk port on the managed switch?

Photo of Kevin Baert

Kevin Baert

  • 28 Posts
  • 1 Reply Like

Hi Hans

We use static VLAN's.

An AP is connected to a switch (HP 1810) which has a port untagged in VLAN10, that same port is also tagged in alle VLAN's that are transmitted by the AP.

It's not configured as a trunk (however this option is possible on our HP switches, but we don't use it).

Photo of BJ

BJ, Champ

  • 374 Posts
  • 45 Reply Likes
Some of your clients are associating to vlan 10, the native/untagged vlan. If you're not trunking, how is traffic being passed via any vlan other than the native?
  
Photo of Jackywong

Jackywong

  • 13 Posts
  • 0 Reply Likes
upgare
Photo of Bob Reisdorf

Bob Reisdorf

  • 3 Posts
  • 3 Reply Likes
The hp provision switches don't use the "trunk" terminology, the "tagged" ports are doing the same function as trunk ports by other vendors. I see the assigned IP address is 0.0.0.0? Are some getting real ip addresses in vlan 10?
Photo of Andrew MacTaggart

Andrew MacTaggart, Champ

  • 483 Posts
  • 86 Reply Likes
trunk is a Cisco term, most other switch companies use tagged or untagged
Photo of Kevin Baert

Kevin Baert

  • 28 Posts
  • 1 Reply Like

Hi

As Bob pointed out, the trunk terminology isn't used anymore on the more recent models of HP switches (1810, 2530).
You just tag, untag or exclude a VLAN on a certain port ...

Users do get an IP address, I checked the DHCP pool of that particular VLAN.

About 10-15 users (of about 200 in total) sometimes get an IP in that range.


Thanks!

Photo of J. Goodnough

J. Goodnough, Champ

  • 266 Posts
  • 32 Reply Likes
I have seen this issue also; in our configuration the management VLAN (1004) is untagged, and the access VLANs (various others) are tagged. On occasion, a few clients will pull addresses from the management VLAN. It doesn't seem to be repeatable and seemed to happen the most often when I was transitioning the APs to the new management network.
Photo of Kevin Baert

Kevin Baert

  • 28 Posts
  • 1 Reply Like

Thanks for the reply!

There is no transitioning going on, wireless network is 'stable' ...

I can't figure this one out, very very strange ...


Photo of Mike Kouri

Mike Kouri, Official Rep

  • 1030 Posts
  • 271 Reply Likes
Kevin,
I suggest you open a support case with your reseller (or Aerohive, if you have a support contract with us) to troubleshoot this further.
Photo of Travis Kaufman

Travis Kaufman, Champ

  • 113 Posts
  • 30 Reply Likes
In your Policy, what is your MGT/UNTAGGED VLAN for your AP's?
Photo of J. Goodnough

J. Goodnough, Champ

  • 266 Posts
  • 32 Reply Likes
1004.
Photo of Andrew MacTaggart

Andrew MacTaggart, Champ

  • 483 Posts
  • 86 Reply Likes
That looks like a reserved vlan
Photo of Jackywong

Jackywong

  • 13 Posts
  • 0 Reply Likes
s
Photo of Travis Kaufman

Travis Kaufman, Champ

  • 113 Posts
  • 30 Reply Likes
Ok, but is VLAN 10 under the policy for a Client VLAN? Also - how many policies are running at this site? 
Photo of J. Goodnough

J. Goodnough, Champ

  • 266 Posts
  • 32 Reply Likes
I can't answer for Kevin's situation, but in my environment VLAN 1004 is not used in any of the 6 user profiles / 18 user VLANs.
Photo of Andrew MacTaggart

Andrew MacTaggart, Champ

  • 483 Posts
  • 86 Reply Likes
to me this smells like a native vlan mismatch

you basically have 2 native vlans configured and so untagged traffic from one vlan hops over to another vlan.

*I would check the ap native vlan with your hp untagged vlan to see if they match.

I generally use a different mgmt vlans and native vlans
Photo of Kevin Baert

Kevin Baert

  • 28 Posts
  • 1 Reply Like

Hi


I think I found the culprit!

Apparantly VLAN 10 is configured as DEFAULT within my two SSID's.

Question is, can I remove this without causing (major) problems?


Photo of Travis Kaufman

Travis Kaufman, Champ

  • 113 Posts
  • 30 Reply Likes
Default should be a VLAN that doesnt exist on your network.  Say 999 or something - Does VLAN 10 exist on that trunk port? 
Photo of Kevin Baert

Kevin Baert

  • 28 Posts
  • 1 Reply Like

Thanks Travis!

and thsi has nothing to do with the connectivity in the management VLAN? This

 is purely SSID related?

Photo of Andrew MacTaggart

Andrew MacTaggart, Champ

  • 483 Posts
  • 86 Reply Likes
I think what Travis was indicating was that the default should be a dummy vlan. In your case it is being assigned to users not getting the vlan assigned properly and it happens to match your mgmt vlan.
Photo of Kevin Baert

Kevin Baert

  • 28 Posts
  • 1 Reply Like

Thanks!


will try this in January (exam period right now, don't want to mess about too much ...) and get back!

Photo of Kevin Baert

Kevin Baert

  • 28 Posts
  • 1 Reply Like

Hi, changed default VLAN to 1, everything works like a charm!

Hopefully case closed!

Thanks everyone!

Photo of Jan Boje

Jan Boje

  • 47 Posts
  • 0 Reply Likes
This is working very fine with a windows PC. But with a Mac it is not working.
We have set dhcp to use the internal DHCP server in Aerohive and we are using broadcast for dhcp. We are using a dummy vlan 
I can see that windows PC is getting an Ip-adress, if you try to get to the internet you will get the portal up. logging in and you are on the internet.

My Mac is not getting an Ip-adress from the DHCP-server. In client monitor we can see that our Mac is trying,