Replacing a router causes ZD1200 not to accept DHCP packets anymore?

[juraj_tobias]

so I have a simple site with 30 APs, cisco switch, a router, and a ZD1200. the router is pfsense - a software running on pretty much generic HW.

I wanted to replace the router device (really simple procedure, just download config from old hw and upload if back to the new one), but after the swap, the wifi clients can't receive a DHCP address (the router acts as DHCP server as well). if I plug a computer directly to the switch, IP address is assigned just fine from dhcp.

on another site, I also have similar setup, but with cisco wireless devices instead of ruckus. as a troubleshooting step, I replaced the pfsense router with the same box I used at the other site, but this time there was no issue - all worked flawlessly with the new hw.

the above would suggest the ZD or APs *somehow* block/ignore the DHCP traffic from the new router (I can see in router logs the DHCP requests are being received and responses are baing sent back). however, I can't find anything in the ZD's configuration that could be causing this.

if anyone has any ideas, i'd greatly appreciate them.

thanks in advance for any responses.

[eizens_putnins]

Hi,

You must have some difference in network setup, ZD is not in the path of DHCP packets at all, and APs work as L2 devices, so problem can't be with WiFi system itself. 

Please, describe you setup -- do you have single subnet, with same VLAN/subnet for APs and clients? Do your new pfsense has same IP as before?

Check if you have set client isolation on WLAN, and if yes, check that gateway/DHCP server address is whitelisted. 

[syamantakomer]

Hi Juraj,

What is the ZD firmware version? If you are on 10.x then please use troubleshooting utility in ZD GUI and track a client's connection.

If WLAN is not tunneled, AP simply pass the traffic as it is received from a client, so I do not think this as an issue on ZD or APs.

Check the VLAN tagging on WLAN and also verify if you are using DHCP relay configuration.

[juraj_tobias]

the moment you realize the solution was right under your nose..

yes, indeed, it was the whitelisted item - didn't remember it also maches MAC address, not just IP (it's logical, ofcourse).

thanks, guys, for pushing me in the right direction!

keep safe and merry whatever-holiday-you-celebrate-nowadays 🙂

[eizens_putnins]

Client isolation works on L2, so it is matching only MACs. You need to whitelist

gateway, as well as DHCP and DNS server, if they are in the same subnet and are different. If DHCP and DNS are outside of segment, gateway will be enough.

Hope it helps