Network Admin Life - Guest Wireless Fix?

[@Sub0x-x40]

lovely introduction sir

[@NetworkAdminLife]

Thank you. God bless!

[@mwafulirwa1]

fingers crossed you have resolved the issue for good...wishing u all the best in this coming back, God bless brother

[@NetworkAdminLife]

Much appreciated my brother! God bless!

[@drooplug]

Why would dhcp issue the same ip to another device if the lease time is not expired? Do you have more than one dhcp server with overlapping scopes?

[@618WARR]

over 17 hours between the two leases … he mentioned the server at the time was set for 16 hour lease times

[@idahofur]

Years ago I had a customer who I thought had a really garbage DSL provider. Finally I was able to go through the network and clean it up. Amazingly a machine got an ip number via dhcp request with the router was unplugged. Well I found a cable modem plugged into the network into an advertising box. It also happened to be plugged into the network and was not suppose to be. Thus, every so many weeks the internet would go down. Oh and this happened for a few years. Non of the techs caught it including me. But, as pointed out you can only do so much during business hours. The whole re-do of the network was after hours. Shortly after they went over to fiber.

[@NetworkAdminLife]

That's the issue. It absolutely should not. But it was happening. And still not completely sure why shortening the DHCP lease time and wireless session time resolved the issue. @ktpdk has the best explanation so far. God bless!

[@changwang7596]

Just a suggestion. Look into dhcp snooping and arp inspection, if you don't already have these features enabled

[@NetworkAdminLife]

I'll take a look. God bless!

[@kkpdk]

I saw this years ago, and in the terms of your data the story goes: At 12:51PM Hao gets a lease valid for 16 hours, and within 8 hours turns off or loses wifi. At 6:22 AM, ~17.5 hours later April is given the address, which is ok. Now Hao gets back on wifi, on the same SSID: Hao's lease has expired, but it expired while the wifi interface was down, and the renewal/expiry timer never fired, so it keeps using the address until forever. You now have two devices with the same IP. I saw it first with iphones, and later with samsung;. My workaround was a huge dhcp pool and a 1 year lifetime, as the client is very likely to connect to another ssid during a year's absence. Whenever the phones change SSID, the lease gets cleared. That doesn't explain the firewall spewing ARP replies at a relatively low rate and not being able to do anything else.

[@NetworkAdminLife]

I think you pretty much nailed what was happening to me. It's the best explanation I've seen so far that even Extreme and Palo Alto couldn't deliver. God bless!

[@drooplug]

Ah, yes. This makes sense. When the client walks out of range, it is unable to release the IP. I can see how a shorter lease time would help this.

[@kkpdk]

Just so I'm sure I'm not misunderstood, this is a bug phone manufacturers have introduced in their dhcp clients. They want to turn off the interface for power saving, and briefly power it up to ask for new events without having to spend time on dhcp. That's fine. What they broke was the requirement from the dhcp spec that says "At half time, try to renew the lease. If it fails, try more aggressively at 87% leasetime. If you still don't get anything, at end of leasetime you MUST stop using that address" by 1) also sleeping the timers and 2) not checking if the lease is expired after restarting the interface. Releasing the address is different - that's when you are being nice. Phone firmware generally isn't nice.. But it appears that Samsung has now reintroduced the bug. I have procured access to an s24, but have been away from work so I haven't been able to test it.

[@drooplug]

@@kkpdk I don't know if it's a bug or out of spec. It seems like it could be. I wonder if this is how dhcp server implementations deal with IP exhaustion. If the IP hasn't been seen in x amount of time, it assigns the address if there aren't any available that are unleased. For me, it would be sensible for the client to see if it's previous IP was taken when it gets back in the network.

[@NetworkAdminLife]

@@kkpdk That is an awesome explanation of the bug. No misunderstanding at all and makes what I was seeing make perfect sense! God bless!

[@theNeWo1]

Could be a person bringing in their own dhcp server in order to intercept traffic to the router. Have you disabled client to client traffic on the guest wireless? Enabled dhcp snooping, arp inspection on the switches?

[@NetworkAdminLife]

I was starting to think so but since we resolved the problem, pretty sure this was not the case. God bless!

[@MrShayjan]

Hi split that setup to 2 SSiD. One should get the portal and one for employees only pre shared key. Run 2 different ip scope with different renewal policies on the palo.

[@NetworkAdminLife]

That's exactly what we do. Unfortunately both SSID's share the same back-end VLAN so when one goes down, the other does too. God bless!

[@samjones4327]

Hey what's up brother! Grace & Peace 2 U! Thanks a lot for this great troubleshooting video! I always enjoy your troubleshooting techniques! I take notes on the techniques and procedures you and many others use to troubleshoot the network! You can't have too many troubleshooting ideas in your tool box! Well I'm praying 4 U ad your family and I appreciate all that you do for us! God Bless brother!🙏🏽

[@NetworkAdminLife]

Yeah, that one was driving me crazy. Looks like it was the firewall, for some reason. I think @ktpdk pretty much called the mechanics behind what was happening. All's well that ends well. Thanks for your prayers. God bless!

[@StrongbowTX]

Is it possible some device was doing proxy-arp and not sending the responses back to the original node properly?

[@NetworkAdminLife]

It's possible but changing the DHCP lease time resolved the problem. God bless!

[@thomassmayhemfishingchanne6812]

Might be a very good idea to have a very short lease time for guest devices and some of these devices can use MAC randomization which can fill your scope

[@NetworkAdminLife]

Yeah, that was ultimately the answer. That and shortening the authentication time that guests could be on their network. God bless!

[@anthonydefallo9295]

Running EXOS and VOSS? Nice! Assuming exos at edge and voss near the core?

[@NetworkAdminLife]

Correct! God bless!

[@anthonydefallo9295]

@@NetworkAdminLife sounds fun! Hope the guest issues get resolved soon!

[@knightjocke]

Since the arps were comming from the fierewall and there was no requests from them it must be something in the firewall.

[@NetworkAdminLife]

I think it had to be part of the issue. Something about the interplay of DHCP lease time (from the firewall) and session time (from the wireless controller). When I shortened both, problem solved. God bless!

[@1Corinthians15v1-4]

Amen! Jesus is Lord! Love your content.

[@NetworkAdminLife]

He is Lord indeed! God bless!

[@Cyba_IT]

Pretty cool how you have a magical entity from another dimension helping you fix networking issues. 😂😂😂

[@NetworkAdminLife]

It IS pretty cool how the God that created all things cares about me. Couldn't agree more. God bless!

[@jaredf0112]

Look at DHCP snooping

[@NetworkAdminLife]

Will do. God bless!

[@idahofur]

Years ago I realized client devices on wireless is stupid. The device itself is stupid. So I always cross my fingers the AP / network does not have any issues.

[@NetworkAdminLife]

Don't forget how stupid the users can be sometimes. God bless!