Resolved iPads hate L3?

[DJLC]

So: I'm in charge of a 1:1 iPad deployment at a school. We've just finished reconfiguring our network with a new firewall, router, and some updated L3 logic.

My MacBooks are working great, PCs are working great, all devices are working great both wired and wireless. EXCEPT iPads. Somehow my iPads are requesting addresses on my management VLAN, which does not / should not give out addresses.

My switch ports are set to management untagged, internal VLAN and guest VLAN tagged. The APs have a management IP statically assigned, internal and guest VLANs defined, and VLANs are associated with the SSIDs. There is no untagged SSID. A Native Route VLAN and Native (untagged) VLAN is not defined on the APs. Our new Cisco ASA has a DHCP Relay defined to send requests to our central DHCP server. My DHCP server has scopes defined for internal and guest. I have not configured IP-Helper on our HP ProCurve core switch, but just received advice that maybe I should.

So — on literally the same SSID, sitting right next to each other, my iPhone gets an IP properly and my iPad does not. Both iOS 9.3.4. On my DHCP server, I can see the request from the iPad coming in on the management subnet, and of course it doesn't have any leases available on that subnet so denies the request.

How in the actual f- could this be happening? I've even tried a factory restore on the iPads — so wifi profiles aren't even installed at that point — with no luck.

 

[DJLC]

False alarm. ID-10T error.

I didn't notice until just now, but our Xirrus APs had a group filter set for a device class of iPad that specified an untagged VLAN. Thus, the APs tore off the 802.1q tags for anything that happened to be an iPad. Don't remember how or why we set that up, but it's gone now and everything works.

Duh. Duh. Duh. Can't believe I've been chasing this for days and it was as simple as that. Mods, feel free to delete this thread. Hopefully nobody else would make such a dumb mistake.

 

[johnmacward]

False alarm. ID-10T error.

I didn't notice until just now, but our Xirrus APs had a group filter set for a device class of iPad that specified an untagged VLAN. Thus, the APs tore off the 802.1q tags for anything that happened to be an iPad. Don't remember how or why we set that up, but it's gone now and everything works.

Duh. Duh. Duh. Can't believe I've been chasing this for days and it was as simple as that. Mods, feel free to delete this thread. Hopefully nobody else would make such a dumb mistake.

Nice bit of troubleshooting all the same. Amazing how you came down to that conclusion. I honestly didn't know that iPad's would be so distinctive in the MAC address to be detected but there you go.

 

[DJLC]

I would be really curious to know how the Xirrus logic works out what type of device it is...... In retrospect, it IS pretty cool that I can segregate devices onto VLANs based on type. But super irritating to me this week! Haha.