Problems between iphone and dhcp?

stephenw10

Hmm, it looks like something is blocking that ARP traffic maybe.

Where was that pcap taken?

You can see pfSense ARPing for the iphone and it never replies.
Then later you can see the iphone ARPing for pfSense and pfSense replies but the iphone just keeps ARPing for it as though it never sees the replies.

Then the iphone sends an ARP announcement and that is seemingly enough for pfSense to populate it's ARP table and respond to pings.

Still something odd there though because after the pings restart the iphone still ARPs for pfSense one last time. Yet at that point it must have the pfSense MAC address already.

Steve

johnpoz

@edpbettinelli

Still not understanding why .146 is not answering arps!

He makes announcements - but doesn't answer when asked.. This is going to be very problematic!

Look in pfsense arp table for this .146 by default arp should be cached for 20 minutes.. But also when asked a client should answer.. So either phone is not getting them? Or is and just not answering?

stephenw10

Seems like something is blocking it since the iphone also appears not to see the ARP replies from pfSense.

johnpoz

@stephenw10 but those are being answered - so pfsense saw the arp, and answered them.

edpbettinelli

@stephenw10 I launched the packet capture on voice vlan with host address 10.135.0.146 in promiscuous mode

Gertjan

Suggestions : some hardware checks :

Take the iPhone out for lunch, and connect somewhere else using Wifi.
Change the cable between the pfSense LAN NIC and the AP.
Change the AP.
Exchange the LAN and WAN NIC.

More difficult : Does your AP have a survey mode ? Can it tell you whatever other wifi networks exist in the neighbourhood ? I mean : radio signals can get get drown in the noise if there are a radio transmitters nearby. These could be other wifi signals, or worse.
pfSense can arp what it want, but what if the arp request never reaches the iPhone ?
(hey apple, can we have a packet capture app for the iPhone ?? :) )
Or, the AP has a lot of power to transmit, the signal reaches the iPhone, but the iPhone, with its small wifi signal, never makes it back to the IP - and then it does for a moment, and then the signal gets lost again etc etc

For what it's worth : if the issue is "ARP" then your close to a hardware issue.

Or someone is really using "ebtables**" in an AP to enforce 'client isolation'. That very subject was one of my first posts on this forum.

Not iptables. ebtables, a MAC based "L2" Linux firewall.

stephenw10

@johnpoz Exactly, but the iphone keeps ARPing for pfSense so it looks like it's not seeing those replies. One could assume it may also not be seeing the ARP requests from pfSense, which is why it never replies.

johnpoz

@stephenw10 said in Problems between iphone and dhcp?:

One could assume it may also not be seeing the ARP requests from pfSense, which is why it never replies.

Quite possible - something clearly is wrong here with the arps.. There should be no reason for pfsense to arp that many times for something. Unless its not getting an answer..

And same goes for the phone for sure.

Something wrong with arp is most likely the root of this issue.

edpbettinelli

@gertjan I will try to do these tests in the test environment, thank you for your suggestion. Furthermore, the replacement of the old wifi extreme bubble with the new Aruba APs is expected in the next few days. At this point I stop for a moment with the tests to try again with the new infrastructure to see if the problem persists.
Thanks everyone for the help

stephenw10

Some proxy-arp happening (or not happening) somewhere? Not sure why it would be in a network like that.

edpbettinelli

@stephenw10
Could it hit something?
https://extremeportal.force.com/ExtrArticleDetail?an=000057732
Could this justify the fact that in the lab with only one ap the problem never appeared, while in the bubble with controller it appears sporadically and only on iphone?

stephenw10

Maybe, if you have that enabled. I don't see anything in the pcap that looks like that specifically but it could be something related.

Steve

edpbettinelli

@stephenw10 In the article in apcontroller mode it is active and cannot be disabled. I have to ask for a check who configured the bubble for us

stephenw10

Definitely worth testing if you can.

It looks like it's definitely not a pfSense issue though.

Steve

edpbettinelli

@stephenw10
Hi everyone,

we have completed the new wifi bubble. I confirm the problem was generated by the old Wifi extreme controller, it is not a Pfsense problem.

Thanks a lot to everyone for the support.

Luca

stephenw10

Thanks for following up. That could save someone else a lot of time.