No DHCP for VLAN 5



  • My setting have been working great and now I can't get DHCP for VLAN5 on my network Unifi AP after reinstalling the Unifi controller software. I've tried loading a previous config on PFSense and redoing the settings on the Unifi without any help. If I setup another wireless on for example VLAN10 in the Unifi AP it works great. My setup is PFSense 2.4.4p3 on Qotom connected to multiple Netgear VLAN aware switched to a Unifi UAP-AC-LR.

    Am I correct that if I can setup VLAN10 on the wireless AP then the problem can't be with my switches or the AP?
    I also tried giving my iphone a static entry in the DHCP server and still can't connect to the internet on that interface.
    Any thoughts would be appreciated.

    DHCP-02.jpg

    DHCP-01.jpg

    DHCP-00.jpg



  • Forgot to mention that on the DHCP logs
    I get DHCP Discover, DHCP Offer on VLAN5 but not DHCP Prequest or DHCP Pack



  • What does Packet Capture show?



  • @JKnott said in No DHCP for VLAN 5:

    What does Packet Capture show?
    Here it is filtered for the iPhone mac address
    17:19:47.238314 f0:c3:71:1e:97:af > ff:ff:ff:ff:ff:ff Null Supervisory, Receiver not Ready, rcv seq 64, Flags [Poll], length 42
    17:19:47.467418 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
    17:19:47.467522 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
    17:19:48.965048 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
    17:19:48.965160 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
    17:19:51.750116 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
    17:19:51.750278 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
    17:19:56.333225 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
    17:19:56.333447 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
    17:20:04.389117 ARP, Request who-has 169.254.249.11 tell 0.0.0.0, length 42
    17:20:04.389346 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
    17:20:04.389551 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
    17:20:04.717252 ARP, Request who-has 169.254.249.11 tell 0.0.0.0, length 42
    17:20:05.040587 ARP, Request who-has 169.254.249.11 tell 0.0.0.0, length 42
    17:20:05.366378 ARP, Request who-has 169.254.249.11 tell 169.254.249.11, length 42
    17:20:05.685559 ARP, Request who-has 169.254.249.11 tell 169.254.249.11, length 42
    17:20:06.011377 ARP, Request who-has 169.254.249.11 tell 169.254.249.11, length 42
    17:20:12.946527 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
    17:20:12.946797 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
    17:20:20.977164 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
    17:20:20.977265 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
    17:20:30.807664 f0:c3:71:1e:97:af > ff:ff:ff:ff:ff:ff Null Supervisory, Receiver not Ready, rcv seq 64, Flags [Poll], length 42
    17:20:38.139183 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
    17:20:38.139385 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300
    17:20:47.057150 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
    17:20:47.057362 IP 192.168.5.1.67 > 192.168.5.41.68: UDP, length 300



  • @NasKar

    Can you provide that as a download file. It makes it a lot easier to read in Wireshark.





  • @NasKar

    You can atttach files here. You don't have to use Dropbox.

    However, here's what's in that offer:

    Frame 3: 342 bytes on wire (2736 bits), 342 bytes captured (2736 bits)
    Ethernet II, Src: Gifa_01:7b:7a (40:62:31:01:7b:7a), Dst: Apple_1e:97:af (f0:c3:71:1e:97:af)
    Internet Protocol Version 4, Src: 192.168.5.1, Dst: 192.168.5.41
    User Datagram Protocol, Src Port: 67, Dst Port: 68
    Bootstrap Protocol (Offer)
    Message type: Boot Reply (2)
    Hardware type: Ethernet (0x01)
    Hardware address length: 6
    Hops: 0
    Transaction ID: 0x037309f6
    Seconds elapsed: 0
    Bootp flags: 0x0000 (Unicast)
    Client IP address: 0.0.0.0 <---- This says the client didn't have an address previously. Typically, it would be the last used address]
    Your (client) IP address: 192.168.5.41 <---- This is what the server is offering.
    Next server IP address: 0.0.0.0
    Relay agent IP address: 0.0.0.0
    Client MAC address: Apple_1e:97:af (f0:c3:71:1e:97:af)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name not given
    Magic cookie: DHCP
    Option: (53) DHCP Message Type (Offer)
    Length: 1
    DHCP: Offer (2)
    Option: (54) DHCP Server Identifier
    Length: 4
    DHCP Server Identifier: 192.168.5.1
    Option: (51) IP Address Lease Time
    Length: 4
    IP Address Lease Time: (86400s) 1 day
    Option: (1) Subnet Mask
    Length: 4
    Subnet Mask: 255.255.255.0
    Option: (3) Router
    Option: (6) Domain Name Server
    Option: (15) Domain Name
    Option: (255) End
    Padding: 000000000000000000000000000000

    As far as I can see, this appears OK. So, the next step would be for the client to request the address, which I don't see. Does this Apple device work on other networks? Do other devices work on this VLAN?



  • the iPhone works on another wireless network on Vlan 40 without issue and other computers in the house can't connect to the VLAN 5 network anymore. I tried to attach the capture with the upload a file option but it kept giving an error. Any thought on were to look for the problem?


  • LAYER 8 Global Moderator

    So pfsense is sending the offer.. So its not pfsense issue.. You need to look why the client is not taking it, or why its not getting it?



  • Thanks that's what I need to know "it's not a pfsense issue"


  • LAYER 8 Global Moderator

    pfsense sees the discover, and sends an offer. Then another discover, so another offer, etc.. You need validate that client is actually getting it... Can you connect a laptop or something to this wifi network and sniff on it? I am not aware of sniffing on a iphone ;)

    If there is - that could be useful!



  • @johnpoz
    I have a laptop but it can't connect to that wifi


  • LAYER 8 Global Moderator

    Why can you not connect it?



  • I have a windows destop connected to vlan 5. Would that work? Don't know how to do sniffing. Do you have a link?



  • @NasKar said in No DHCP for VLAN 5:

    have a windows destop connected to vlan 5. Would that work? Don't know how to do sniffing. Do you have a link?

    Yes, it should work find. It works the same way via WiFi or Ethernet. You can install Wireshark on the computer.



  • @NasKar Stupid question: You have the VLAN-tags enabled/disabled correctly on the switch and on the firewall? If you don't run tcpdump with -vvv you do not see the vlan tags and you'll be chasing ghosts....



  • I have wireshark on the windows computer. Don't know how to use it.

    @Grimeton said in No DHCP for VLAN 5:

    Stupid question: You have the VLAN-tags enabled/disabled correctly on the switch and on the firewall? If you don't run tcpdump with -vvv you do not see the vlan tags and you'll be chasing ghosts....

    Everything was working well earlier today and I can login to another wireless VLAN on the same access point so I presume it is not a problem with my switches. Is that correct?



  • @NasKar

    #1 Rule of networking: We don't want to assume, we want to know.

    Depending on how your switch is configured and handles tagged frames on an untagged port: delete them, forward them untouched (QinQ), remove the tag and so on, it can work and it cannot work. It's important to VERIFY the configuration along the way.

    Cu



  • @Grimeton said in No DHCP for VLAN 5:

    Depending on how your switch is configured and handles tagged frames on an untagged port: delete them, forward them untouched (QinQ), remove the tag and so on, it can work and it cannot work. It's important to VERIFY the configuration along the way.

    My setup is not ideal I have 4 netgear switches between the pfsense and the AP. Would have been best to have one switch with all the cables going directly to it. I can try to move the AP temporarily to the switch connected to the pfsense



  • @NasKar
    If the interface on the pfSense is tagged and the interface on the switch is NOT tagged this can lead to all kind of confusions. Same happens when vice versa.

    So it's important to know that your VLAN-configuration on pfSense and on the switch is fine.

    As DHCP is a system that uses broadcast and relies more on L2 than on L3, having a valid and working VLAN-config is important.



  • @Grimeton

    Given the phone is sending out discovers and receiving offers, that's not an issue. Also, you'd not see VLAN tags on a switch port that's already been assigned to a VLAN.



  • @JKnott I can tell you from experience that all you've just written is false.



  • @NasKar

    Four switches is not a problem if they're configured properly. You have a VLAN. I assume you have the VLAN configured on pfSense and any switch that has to pass VLAN frames configured appropriately. At some point, either a switch or in the AP, the VLAN frames are converted to native frames, by removing the VLAN tags. However, given that you're getting an offer after a discover, there is communication between the iPhone and DHCP server, so I doubt VLAN tags are the problem.



  • @Grimeton

    False in what way? I have viewed the captured traffic in Wireshark and I can see the discover, coming from the iPhone, followed immediately by the offer, coming from the DHCP server. That tells me the phone and server are communicating up to that point. The next step is for the phone to request the offered address, but that's not happening. The question is why. If it was a VLAN issue, we'd see the discover, but not the offer.



  • @JKnott This is pointless. I'm not here to measure the size of my dick. I can tell you from experience that switches are the most buggy devices on earth. They leak all kinds of information across VLANs, while other devices like to ignore VLAN-tags in the L2-header based on the moon phase. Especially when it comes to WIFI. There are WIFI devices that forward VLAN-tagged packets and the receiving device just happily ignores them.

    So from my experience it's important to make sure that the configuration is fine, ESPECIALLY when the communication is just lost in a brodcasted setup like this one.



  • @Grimeton

    Please explain why there's an offer, if the devices are not communicating. If there was a switch failure, there would be no offer, as the server wouldn't have heard from the phone.

    Have you looked at that capture? I have it opened in Wireshark right now.


  • LAYER 8 Global Moderator

    We know that pfsense gets the discover and makes the offer, we have no idea if the phone is getting it.

    You really need to validate that by connecting to the wifi if that is where your having a problem.

    Are you saying these are 4 dumb switches between your AP and pfsense?



  • I just noticed something curious, though I doubt it has anything to do with the problem. The first frame in the capture is an 802.3 LLC frame, whereas everything to do with IP uses Ethernet ll frames.



  • @JKnott The trace is from one end of the problem.

    The device requests an IP-address and gets handed an offer. If the WIFI-device is forwarding the L2 package with tagged headers the phone might be lost/ignoring it, hence the answer is thrown away.

    Just one explanation.

    So please, please, please, with lots of sugar on top of it. Make sure that the VLAN-configuration is fine across all devices.


  • LAYER 8 Global Moderator

    Exactly!! Where exactly was this sniff taken? On the pfsense vlan interface?



  • @Grimeton

    Again, there is no sign of VLAN tags in the capture, from either end. Also, devices not configured for VLANs should not accept them. For them to do that, it means accepting a frame with the wrong Ethertype. The frames show the Ethertype for IPv4, not VLAN, which means the VLAN tags have been removed before that point.


  • LAYER 8 Global Moderator

    If he is sniffing on the vlan interface vs the parent physical he wouldn't see the tags in his sniff.. He would have to sniff on the parent physical interface with -e to see the tags.



  • @JKnott Depending on WHERE the trace was taken you do not see VLAN-tags because they were filtered out by a lower layer.

    But above in the description people are talking about VLANs and VLAN5.

    So we ASSUME that it's 802.1q.


  • LAYER 8 Global Moderator

    ^ exactly I would for assure assume 802.1q but he prob sniffed on the vlan interface directly... But lets make sure we know exactly where that sniff was taken.

    And we don't have a sniff from the other end via a wireless client (laptop) connected to that same ssid do we?



  • @johnpoz said in No DHCP for VLAN 5:

    Exactly!! Where exactly was this sniff taken? On the pfsense vlan interface?

    If taken there, I'd expect to see VLAN tags, unless the port connects to a managed switch that puts the frame on a VLAN. So, we'd expect VLAN tags somewhere, but we haven't yet determined where they're added & removed. If it's just dumb switches, then we'd see VLAN tags everywhere between pfSense and the AP. However, I believe that capture was taken on the network used for the AP, which is VLAN 5 somewhere, but there are no tags at that point.


  • LAYER 8 Global Moderator

    You wouldn't see the tag if you sniffed in pfsense gui on the vlan.



  • @johnpoz

    Yeah besides that, tagged L2 packets via WiFi are a a thing on its own. As I wrote before: some devices ignore the tags and take the packet, others ignore the packets completely and so on...

    It gets really nasty really quick if this isn't setup correctly.


  • LAYER 8 Global Moderator

    @Grimeton said in No DHCP for VLAN 5:

    It gets really nasty really quick if this isn't setup correctly.

    Preaching to the choir there my friend ;)



  • @Grimeton said in No DHCP for VLAN 5:

    So we ASSUME that it's 802.1q.

    Again, at what point? Where was that capture taken? Where ever it was, there are no VLAN tags. If you don't believe me, download that capture file and look at it in Wireshark.


  • LAYER 8 Global Moderator

    And again @JKnott if you sniff in the gui in pfsense on the vlan interface - you will not see any tags!


Log in to reply