Problems between iphone and dhcp?

johnpoz

@edpbettinelli said in Problems between iphone and dhcp?:

the dns assigned by dhcp are obviously not blocked

They are not getting any answers..

In neither of your sniffs do I see any dns answers.. Maybe its asking something else.. But there are no answers to dns in either of your sniffs.

And why is .146 not answering any arps?

edpbettinelli

@johnpoz At this moment I don't know how to give you an answer. I'd like to say that I stopped packet capture before connectivity resumed. I will try to do other tests in the lab even if I haven't verified the problem yet. In production it is now risky to test now. However, at a company not in production I will try again to make some captures.
Thank you very much for helping

johnpoz

@edpbettinelli here is the thing - the really odd thing is why .146 is not answering the arps.. But pfsense for sure could not answer a ping, if he doesn't have the mac address of .146 in his arp table.. If he had the mac in his arp table, he shouldn't need to arp for it..

I would really look to why not answering those arps..

edpbettinelli

@johnpoz I forced the situation and I think I can provide you with the correct capture. After the block comes the replies as well. I confirm that the previous capture was aborted before reconnection.completo-packetcapture.cap

stephenw10

Hmm, it looks like something is blocking that ARP traffic maybe.

Where was that pcap taken?

You can see pfSense ARPing for the iphone and it never replies.
Then later you can see the iphone ARPing for pfSense and pfSense replies but the iphone just keeps ARPing for it as though it never sees the replies.

Then the iphone sends an ARP announcement and that is seemingly enough for pfSense to populate it's ARP table and respond to pings.

Still something odd there though because after the pings restart the iphone still ARPs for pfSense one last time. Yet at that point it must have the pfSense MAC address already.

Steve

johnpoz

@edpbettinelli

Still not understanding why .146 is not answering arps!

He makes announcements - but doesn't answer when asked.. This is going to be very problematic!

Look in pfsense arp table for this .146 by default arp should be cached for 20 minutes.. But also when asked a client should answer.. So either phone is not getting them? Or is and just not answering?

stephenw10

Seems like something is blocking it since the iphone also appears not to see the ARP replies from pfSense.

johnpoz

@stephenw10 but those are being answered - so pfsense saw the arp, and answered them.

edpbettinelli

@stephenw10 I launched the packet capture on voice vlan with host address 10.135.0.146 in promiscuous mode

Gertjan

Suggestions : some hardware checks :

Take the iPhone out for lunch, and connect somewhere else using Wifi.
Change the cable between the pfSense LAN NIC and the AP.
Change the AP.
Exchange the LAN and WAN NIC.

More difficult : Does your AP have a survey mode ? Can it tell you whatever other wifi networks exist in the neighbourhood ? I mean : radio signals can get get drown in the noise if there are a radio transmitters nearby. These could be other wifi signals, or worse.
pfSense can arp what it want, but what if the arp request never reaches the iPhone ?
(hey apple, can we have a packet capture app for the iPhone ?? :) )
Or, the AP has a lot of power to transmit, the signal reaches the iPhone, but the iPhone, with its small wifi signal, never makes it back to the IP - and then it does for a moment, and then the signal gets lost again etc etc

For what it's worth : if the issue is "ARP" then your close to a hardware issue.

Or someone is really using "ebtables**" in an AP to enforce 'client isolation'. That very subject was one of my first posts on this forum.

Not iptables. ebtables, a MAC based "L2" Linux firewall.

stephenw10

@johnpoz Exactly, but the iphone keeps ARPing for pfSense so it looks like it's not seeing those replies. One could assume it may also not be seeing the ARP requests from pfSense, which is why it never replies.

johnpoz

@stephenw10 said in Problems between iphone and dhcp?:

One could assume it may also not be seeing the ARP requests from pfSense, which is why it never replies.

Quite possible - something clearly is wrong here with the arps.. There should be no reason for pfsense to arp that many times for something. Unless its not getting an answer..

And same goes for the phone for sure.

Something wrong with arp is most likely the root of this issue.

edpbettinelli

@gertjan I will try to do these tests in the test environment, thank you for your suggestion. Furthermore, the replacement of the old wifi extreme bubble with the new Aruba APs is expected in the next few days. At this point I stop for a moment with the tests to try again with the new infrastructure to see if the problem persists.
Thanks everyone for the help

stephenw10

Some proxy-arp happening (or not happening) somewhere? Not sure why it would be in a network like that.

edpbettinelli

@stephenw10
Could it hit something?
https://extremeportal.force.com/ExtrArticleDetail?an=000057732
Could this justify the fact that in the lab with only one ap the problem never appeared, while in the bubble with controller it appears sporadically and only on iphone?

stephenw10

Maybe, if you have that enabled. I don't see anything in the pcap that looks like that specifically but it could be something related.

Steve

edpbettinelli

@stephenw10 In the article in apcontroller mode it is active and cannot be disabled. I have to ask for a check who configured the bubble for us

stephenw10

Definitely worth testing if you can.

It looks like it's definitely not a pfSense issue though.

Steve

edpbettinelli

@stephenw10
Hi everyone,

we have completed the new wifi bubble. I confirm the problem was generated by the old Wifi extreme controller, it is not a Pfsense problem.

Thanks a lot to everyone for the support.

Luca

stephenw10

Thanks for following up. That could save someone else a lot of time.