No DHCP for VLAN 5

NasKar

What does Packet Capture show?
Here it is filtered for the iPhone mac address
17:19:47.238314 f0:c3:71:1e:97:af > ff:ff:ff:ff:ff:ff Null Supervisory, Receiver not Ready, rcv seq 64, Flags [Poll], length 42
17:19:47.467418 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
17:19:47.467522 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
17:19:48.965048 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
17:19:48.965160 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
17:19:51.750116 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
17:19:51.750278 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
17:19:56.333225 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
17:19:56.333447 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
17:20:04.389117 ARP, Request who-has 169.254.249.11 tell 0.0.0.0, length 42
17:20:04.389346 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
17:20:04.389551 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
17:20:04.717252 ARP, Request who-has 169.254.249.11 tell 0.0.0.0, length 42
17:20:05.040587 ARP, Request who-has 169.254.249.11 tell 0.0.0.0, length 42
17:20:05.366378 ARP, Request who-has 169.254.249.11 tell 169.254.249.11, length 42
17:20:05.685559 ARP, Request who-has 169.254.249.11 tell 169.254.249.11, length 42
17:20:06.011377 ARP, Request who-has 169.254.249.11 tell 169.254.249.11, length 42
17:20:12.946527 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
17:20:12.946797 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
17:20:20.977164 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
17:20:20.977265 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
17:20:30.807664 f0:c3:71:1e:97:af > ff:ff:ff:ff:ff:ff Null Supervisory, Receiver not Ready, rcv seq 64, Flags [Poll], length 42
17:20:38.139183 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
17:20:38.139385 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
17:20:47.057150 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
17:20:47.057362 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300

JKnott

@NasKar

Can you provide that as a download file. It makes it a lot easier to read in Wireshark.

NasKar

@JKnott
https://www.dropbox.com/s/re22sqgcgg5tjw7/packetcapture.cap?dl=0

JKnott

@NasKar

You can atttach files here. You don't have to use Dropbox.

However, here's what's in that offer:

Frame 3: 342 bytes on wire (2736 bits), 342 bytes captured (2736 bits)
Ethernet II, Src: Gifa_01:7b:7a (40:62:31:01:7b:7a), Dst: Apple_1e:97:af (f0:c3:71:1e:97:af)
Internet Protocol Version 4, Src: 192.168.5.1, Dst: 192.168.5.41
User Datagram Protocol, Src Port: 67, Dst Port: 68
Bootstrap Protocol (Offer)
Message type: Boot Reply (2)
Hardware type: Ethernet (0x01)
Hardware address length: 6
Hops: 0
Transaction ID: 0x037309f6
Seconds elapsed: 0
Bootp flags: 0x0000 (Unicast)
Client IP address: 0.0.0.0 <---- This says the client didn't have an address previously. Typically, it would be the last used address]
Your (client) IP address: 192.168.5.41 <---- This is what the server is offering.
Next server IP address: 0.0.0.0
Relay agent IP address: 0.0.0.0
Client MAC address: Apple_1e:97:af (f0:c3:71:1e:97:af)
Client hardware address padding: 00000000000000000000
Server host name not given
Boot file name not given
Magic cookie: DHCP
Option: (53) DHCP Message Type (Offer)
Length: 1
DHCP: Offer (2)
Option: (54) DHCP Server Identifier
Length: 4
DHCP Server Identifier: 192.168.5.1
Option: (51) IP Address Lease Time
Length: 4
IP Address Lease Time: (86400s) 1 day
Option: (1) Subnet Mask
Length: 4
Subnet Mask: 255.255.255.0
Option: (3) Router
Option: (6) Domain Name Server
Option: (15) Domain Name
Option: (255) End
Padding: 000000000000000000000000000000

As far as I can see, this appears OK. So, the next step would be for the client to request the address, which I don't see. Does this Apple device work on other networks? Do other devices work on this VLAN?

NasKar

the iPhone works on another wireless network on Vlan 40 without issue and other computers in the house can't connect to the VLAN 5 network anymore. I tried to attach the capture with the upload a file option but it kept giving an error. Any thought on were to look for the problem?

johnpoz

So pfsense is sending the offer.. So its not pfsense issue.. You need to look why the client is not taking it, or why its not getting it?

NasKar

Thanks that's what I need to know "it's not a pfsense issue"

johnpoz

pfsense sees the discover, and sends an offer. Then another discover, so another offer, etc.. You need validate that client is actually getting it... Can you connect a laptop or something to this wifi network and sniff on it? I am not aware of sniffing on a iphone ;)

If there is - that could be useful!

NasKar

@johnpoz
I have a laptop but it can't connect to that wifi

johnpoz

Why can you not connect it?

NasKar

I have a windows destop connected to vlan 5. Would that work? Don't know how to do sniffing. Do you have a link?

JKnott

@NasKar said in No DHCP for VLAN 5:

have a windows destop connected to vlan 5. Would that work? Don't know how to do sniffing. Do you have a link?

Yes, it should work find. It works the same way via WiFi or Ethernet. You can install Wireshark on the computer.

Grimeton

@NasKar Stupid question: You have the VLAN-tags enabled/disabled correctly on the switch and on the firewall? If you don't run tcpdump with -vvv you do not see the vlan tags and you'll be chasing ghosts....

NasKar

I have wireshark on the windows computer. Don't know how to use it.

@Grimeton said in No DHCP for VLAN 5:

Stupid question: You have the VLAN-tags enabled/disabled correctly on the switch and on the firewall? If you don't run tcpdump with -vvv you do not see the vlan tags and you'll be chasing ghosts....

Everything was working well earlier today and I can login to another wireless VLAN on the same access point so I presume it is not a problem with my switches. Is that correct?

Grimeton

@NasKar

#1 Rule of networking: We don't want to assume, we want to know.

Depending on how your switch is configured and handles tagged frames on an untagged port: delete them, forward them untouched (QinQ), remove the tag and so on, it can work and it cannot work. It's important to VERIFY the configuration along the way.

Cu

NasKar

@Grimeton said in No DHCP for VLAN 5:

Depending on how your switch is configured and handles tagged frames on an untagged port: delete them, forward them untouched (QinQ), remove the tag and so on, it can work and it cannot work. It's important to VERIFY the configuration along the way.

My setup is not ideal I have 4 netgear switches between the pfsense and the AP. Would have been best to have one switch with all the cables going directly to it. I can try to move the AP temporarily to the switch connected to the pfsense

Grimeton

@NasKar
If the interface on the pfSense is tagged and the interface on the switch is NOT tagged this can lead to all kind of confusions. Same happens when vice versa.

So it's important to know that your VLAN-configuration on pfSense and on the switch is fine.

As DHCP is a system that uses broadcast and relies more on L2 than on L3, having a valid and working VLAN-config is important.

JKnott

@Grimeton

Given the phone is sending out discovers and receiving offers, that's not an issue. Also, you'd not see VLAN tags on a switch port that's already been assigned to a VLAN.

Grimeton

@JKnott I can tell you from experience that all you've just written is false.

JKnott

@NasKar

Four switches is not a problem if they're configured properly. You have a VLAN. I assume you have the VLAN configured on pfSense and any switch that has to pass VLAN frames configured appropriately. At some point, either a switch or in the AP, the VLAN frames are converted to native frames, by removing the VLAN tags. However, given that you're getting an offer after a discover, there is communication between the iPhone and DHCP server, so I doubt VLAN tags are the problem.