9800-40 mobility to 9800-40 setup

[Michael Voity]

Hello Community, 

I have read the article - 
https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213913-building-mobility-tunnels-on-catalyst-98.html

I want to enable the mobility between 2 of my controllers to get rid of errors for when my users roam from 1 side of campus to the other.  We are higher edu,   Academic Admin controller vs Residential Controller.

I understand I need v4 Multicast routing enabled on the router of where the Wireless management vlan's live

My questions are -    when i enable this,  will it bounce APs and or clients off the controller when its enabled on both controllers as it forms the tunnel?  Do i need pim running on each of the wireless managemnet vlan's?

Thank you in advance for any reply.

-Mike

[balaji.bandi]

when i enable this,  will it bounce APs and or clients off the controller when its enabled on both controllers as it forms the tunnel?  

No there is no effect on the AP or exiting connections.

Just follow the guide you do not need anything else. Make sure in the path any firewall required ports to be open.

if both CAT 9800 follow below guide :

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213912-configure-mobility-anchor-on-catalyst-98.html

[Michael Voity]

Wow that was fast.   Thank you .

Questions,  Once i build the tunnel from the first guide, 9800 <-> 9800 I need to do the anchor and forgien policys on each controller in order for the mobility to work?    What happens if i do not do the guide you posted?

Reason for wanting to do mobility is that i have clients that use a device in class that are one 1 controller and then go back to their residence that is on another controller.   I am seeing users having issues with onboarding  where they are getting ip theft  errors  and  DHCP NAK: Requested address not in the pool or in a different subnet or already in use by another client 

Thoughts?

Thanks in advance again.

-Mike

[marce1000]

 - In general ; when trying to config the controllers you can always check the intended configuration with the CLI command 
show tech wireless and feed the output into : Wireless Config Analyzer
                                                Using WirelessAnalyzer is a must do!

 M.

[Rich R]

Anchor-foreign is really only intended for guest-DMZ setups if that's what you're intending.
If you're just wanting to support simple mobility then no need for anchor-foreign setup.

Hard to comment on ip theft without more detail on topology and setup.
Presume you're aware that in early versions of 9800 software the developers mistakenly assumed that no 2 users could ever have the same IP resulting in false "ip theft" errors and outages for users.  They had to add the "ip overlap" feature from 17.3.3 to allow this - see:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-4/config-guide/b_wl_17_4_cg/m_vewlc_flex_connect.html#Cisco_Concept.dita_b7aa7e2e-9efb-4bcb-9d75-27eb91f6662f Overlapping Client IP Address in Flex Deployment
https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html#FlexConnectsitetag
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvr98802

More generally make sure you've been through the Best Practice guide below and make sure your WLC code is up tp date as per the TAC recommended link below.

[Michael Voity]

Thank you all for  your replys!

I was able to get the mobility tunnel setup and working.

This is the error i am seeing frequently - 
CLIENT_ORCH_LOG-5-ADD_TO_BLACKLIST_REASON: Chassis 1 R0/0: wncd: Client MAC: 1edf.0d51.9145 with IP: 10.245.92.183 was added to exclusion list, legit Client MAC: 5a8e.740d.eb26, IP: 10.245.92.183, reason: IP address theft

I am also starting to see this message too - 

%CLIENT_EXCLUSION_SERVER-5-ADD_TO_BLACKLIST_REASON_DYNAMIC: Chassis 1 R0/0: wncmgrd: Client MAC: 1acd.9197.2751 was added to exclusion list associated with AP Name:CCRH-W-136, BSSID:MAC: a03d.6f47.dbe0, reason:Excluded by Mobility Peer

My topology is simple  Academic Controller and Residential Controller, Both have same SSID's  but different client vlans based on geographic area.

Example,  student goes to class on Library, connects to SSID,  gets put in the “central student” client group, on the Academic Admin Controller.   Leaves class to arrive at resident hall, connects to SSID  and get put in the “wdw” clinet group of the ResHall Controller.    It will be hit or miss if the user will get the following error on the DNA center or controller.-  ip theft  errors  and  DHCP NAK: Requested address not in the pool or in a different subnet or already in use by another client 

Thank you in advance for any replys!

-Mike

[balaji.bandi]

Is the both the SSID use same  IP pool ? as you mentioned they are different client groups ?

what is your DHCP timeout ?

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/b_wl_16_10_cg/ip-theft.html

[Michael Voity]

Thanks again for the response.

Not the same IP pool,   client vlans based on geographic area, each client group is a /20

I can not find the DHCP timeout  in the config, cli,  looking at best practice says its a fixed value of 120.

I have a tac case open about this, not going anywhere,  they said initially that "IP theft on the WLC as it is a good feature to have on the 9800."

I am leaning towards disabling it as the command "show wireless exclusionlist "  is showing a lot of mac's and the count down to release them.

Thanks again for the reply.

-Mike

[balaji.bandi]

I mean to say how is your lease time in the DHCP Server.

you can also try  - profile policy

exclusionlist timeout X 

[Michael Voity]

Most subnets are at 28800 seconds.

Thanks again.