This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG and UniFi WLAN Controller > DHCP Timeout

Florian Krammer over 5 years ago

Hi guys,

the following installation:

Gateway/DHCP: Sophos XG86 v.18.2

UniFi Cloudkey Gen2 v 5.14.23

3x UniFi AP AC FlexHD (Current firmware)

Clients: iPhones, iPads, MacBooks

The following problem:

The APs provide a Mesh WLAN and there are always problems with the AP change, that the clients obviously don't get an IP address. This means that the connection to the AP only works if the client reports: No internet connection or if you look at the details, he doesn't get an IP. In the Sophos log it constantly reports errors from the AP to the cloudkey with invalid traffic:

Here the error on the unifi controller:

The WLAN is not separated and runs in the LAN of the XG and also uses the DHCP server.

It would be great if someone had an idea or an approach to what this could be due.

Thanks a lot and best regards

This thread was automatically locked due to age.

Parents

0 rfcat_vk over 5 years ago

Hi,

try increasing the DHCP address renew time and report back your results.

Also the errors indicate there is no firewall rule matching that and there are no active connections.

Further review the logviewer -> system report to see how often the IP addresses are refreshed?

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Florian Krammer over 5 years ago in reply to rfcat_vk

Hello Ian, thank you for your feedback.

The DHCP server is running on default: default lease time 1440, maximum lease time 2880.

The devices are on the Sophos LAN, I have a LAN to LAN rule:
Source: LAN, Any Host
Destination: LAN, Any Host
What: Any Service Accept

I cannot find any entries for IP address assignment in the Log viewer. I only see entries for DDNS ...

Best regards Flo
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Florian Krammer over 5 years ago in reply to rfcat_vk

Hello Ian, thank you for your feedback.

The DHCP server is running on default: default lease time 1440, maximum lease time 2880.

The devices are on the Sophos LAN, I have a LAN to LAN rule:
Source: LAN, Any Host
Destination: LAN, Any Host
What: Any Service Accept

I cannot find any entries for IP address assignment in the Log viewer. I only see entries for DDNS ...

Best regards Flo
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 rfcat_vk over 5 years ago in reply to Florian Krammer

Hi Florian,

what assignments do see in the XG DHCP server?

also do the APs pass address requests or do they assign them?
are you APS on a seperate interface on thee XG?
ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Florian Krammer over 5 years ago in reply to rfcat_vk

Here a screenshot:

The APs use Static IP MAC mapping

The controller hangs on port 4 the APs on port 3 in a bridge-pair and have no separate network or zone, they are in the LAN of the XG.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 5 years ago in reply to Florian Krammer

Hi Florian,

how many DHCP servers are you using, one on each port or are you using relay?

DHCP request will not be passed by LAN to LAN rules because they are a broadcast.

Looking at those log entries would tend to indicate your device has a failing network connection and see the carrier drop and therefore requests a new address.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 Florian Krammer over 5 years ago in reply to rfcat_vk

Hi Ian, There is only one DHCP server assigned on the bridge. Ok, Then I don't need a rule? The APs are connected with 1G cable ...
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 5 years ago in reply to Florian Krammer

Hi Florian,

Is there a timeout setting on the APs, so when the connections fail does the interface show connected?

JIan
Cancel
Vote Up 0 Vote Down

Cancel
0 Florian Krammer over 5 years ago in reply to rfcat_vk

Hi Ian,

no settings. Here the network settings of the wlan-controller (uniFi cloud key):

Here the network setting of the APs:

Here you can select static or DHCP ... Thats all.

Florian
Cancel
Vote Up 0 Vote Down

Cancel
0 Florian Krammer over 5 years ago in reply to Florian Krammer

Hi Ian, think this is the solution:

https://support.sophos.com/support/s/article/KB-000035606?language=en_US

do you believe that too?

thx for feedback und best regards

Florian

WRONG! I have misinterpreted "bridge mode" ....
Cancel
Vote Up 0 Vote Down

Cancel
0 LuCar Toni over 5 years ago in reply to Florian Krammer

You should connect to the CLI and perform a tcpdump. Likely you should see the Port 67 or Port 68 Requests. So you can follow up on what is actually causing the Problem.

https://danielmiessler.com/study/tcpdump/

https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol
Cancel
Vote Up 0 Vote Down

Cancel