Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE Cupertino 17.7.x

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book
Available Languages
Download Options

Book Title

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE Cupertino 17.7.x

Chapter Title

Disabling IP Learning in FlexConnect Mode

Results

Updated:
May 19, 2023

Chapter: Disabling IP Learning in FlexConnect Mode

Disabling IP Learning in FlexConnect Mode

Information About Disabling IP Learning in FlexConnect Mode

In customer deployment scenario, you have FlexConnect local switching configured where all clients receive the same IP using Wireless Gateway Access (WAG). The wireless controller receives the IP information using ARP, DHCP packet, or IAPP packets. As IP is the same for all the clients, the controller discards the client on the basis of IP theft.

The Disabling IP learning in FlexConnect mode feature utilizes the existing no ip mac-binding command to ensure that no device tracking is done for clients. Thereby, IP theft failure does not occur in clients.

Prerequisite for Disabling IP Learning in FlexConnect Mode

  • This feature supports only IPv4.

Restrictions for Disabling IP Learning in FlexConnect Mode

  • The wireless client ip ip-addr command works by referring to the IP table binding entries directly. It does not work for client whose IPs are not learnt.

  • Overlapping IP address in a site tag and across site tag require different settings. Also, a single site tag with overlapping IP address requires L3 web authentication. The L3 web authentication is based on IP address and the uniqueness of the IP address cannot be guaranteed. Hence, this is a wrong combination.

  • When IP Source Guard (IPSG) is enabled and multiple binding information is sent with the same IP and preference level (such as DHCP, ARP, and so on) to CPP, the CPP starts to ignore the later bindings after the first binding creation. Hence, you should not configure IPSG and no ip mac-binding together. If IPSG and no ip mac-binding are configured together then IPSG does not work.

Disabling IP Learning in FlexConnect Mode (CLI)

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

no ip mac-binding

Example:

Device(config)# no ip mac-binding

Disables IP learning in FlexConnect mode.

Step 3

end

Example:

Device(config)# end

Returns to privileged EXEC mode.

Verifying IP Entries from Database

To verify the IP entries from database, use the following command:

Device# show wireless device-tracking database IP
IP                                          ZONE-ID     STATE       DISCOVERY   MAC
  ----------------------------------------------------------------------------------------------
  9.9.64.95                                   0x00000000  Reachable   Local       001e.14b6.53ff
  2009:300:300:64::95                         0x00000000  Reachable   Local       001e.14b6.53ff
  fe80::21e:14ff:feb6:53ff                    0x80000040  Reachable   Local       001e.14b6.53ff

* On a redundant system, IP database is only available only on the active chassis

To verify the MAC details from database, use the following command:

Device# show wireless device-tracking database mac
  MAC             VLAN  IF-HDL      IP
  --------------------------------------------------------------------------------------------------
  6c96.cff2.889a  64    0x90000008  9.9.64.175

Was this Document Helpful?

FeedbackFeedback

Contact Cisco