Static IP assigned no longer 'works'...

[Koldov]

On Friday at 15:30 the Headteacher gave me their Macbook to install an SSL certificate so I can enable HTTPS inspection for the last remaining part of our network.

 

It might be coincidence, but after doing this I noticed there was no network/internet access.

 

After much testing I have finally found the following:

 

Setting it to the original static IP of 1.2.3.4 means no network or internet access...

 

The static IP comes from the correct VLAN sub and is in the excluded IP address range...

 

So, as the excluded range is 1.2.3.4 > 1.2.3.4.9.... I just chose the next static of 1.2.3.5 and it worked!

 

Cisco WLC 5508 > Cisco Core Switch 3750 (acting as DHCP server).

 

When setting the Macbook IP address to the original static IP of 1.2.3.4, on the WLC tracing it by MAC address shows an IP of 0.0.0.0 but with the new static, it shows correctly as 1.2.3.5 - so I presume I can rule out any actual issue with the 'mechanics' of what I'm doing...

 

Is there any way I can find out what's wrong with the original static IP?

 

Is there some CLI command I can run on the switch to determine if it has been blacklisted somehow?

Edited May 13, 2024 by Koldov

[ToyHeartsFan]

I slowly got rid of the LEA’s managed 10/100 Cisco switches and replaced them with simple Cisco SG200 smart switches so we had gigabit to the desktop.

 

Budgets were tight, we had 9 comms cabs and circa 15 switches so high end switches weren’t an option; they were fine for what we needed at the time and I would update the firmware each year during one of the holidays.

 

Our simple setup meant I didn’t need to manage a layer 3 switch so someone that is managing a layer 3 switch might be able to give you more insight into your discontinued Cisco 3750.

 

 

https://www.cisco.com/c/en/us/support/switches/catalyst-3750-series-switches/series.html

 

 

https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3750-series-switches/product_data_sheet0900aecd80371991.html

 

 

From the data sheet it appears they have a security feature that “might” be able to cause this:

 

“IP source guard prevents a malicious user from spoofing or taking over another user’s IP address by creating a binding table between client’s IP and MAC address, port, and VLAN.“

 

 

Is there any chance Apples privacy feature on the macbook has changed its MAC address?

 

I’m assuming there’s no CCTV engineers etc. been on site recently that could have set a static IP on a camera etc. that’s causing an IP conflict?

 

 

You could just use the new IP address and leave it a that otherwise I would try looking into the CISCO Network Assistant software mentioned in the data sheet so you can access the GUI and update the firmware, it might be worth giving your network support company a call for some advice. The switches will need replacing now they no longer get security updates even if you do update to the latest firmware.

 

 

 

“Cisco Network Assistant Software provides an easy-to-use, Web-based management interface through a standard Web browser.”

 

 

“Drag-and-Drop Cisco IOS Software upgrade simplifies the process of upgrading Cisco IOS Software by not involving a Trivial File Transfer Protocol (TFTP) server.

 

• The software upgrade feature allows one-click software upgrade of multiple switches in a community of Cisco Catalyst 3750-E, 3750, 3560-E, 3560, 3550, 2960, and 2950 Series Switches. Configuration cloning facilitates rapid deployment of networks. The master switch automatically upgrades each stack.”

[dmj]

There's this newfangled automatic thing from that prevents ip mis-configurations and issues like this.

It works by suggesting to a server an address and the server responding with a 'yes' or a different address.

You should try it. It's been well battle tested over the last 30 years.

[Davit2005]

There's this newfangled automatic thing from that prevents ip mis-configurations and issues like this.

It works by suggesting to a server an address and the server responding with a 'yes' or a different address.

You should try it. It's been well battle tested over the last 30 years.

 

Sorry it made me laugh.

 

@Koldov, have you thought of a reservation instead of static.

 

2 reasons, one you can manage it without needing access to the device the other is that you have a central location where you can see all IPs.

 

Back in 1996 I looked after a small engineering firms network (additional role to existing daily role before I'd even thought about this crazy IT thingy as a career) and even with jus 25 devices it was a PITA to keep track of the IP addresses and I did not know too much about DHCP back then, lol

Edited May 14, 2024 by Davit2005

[Koldov]

“IP source guard prevents a malicious user from spoofing or taking over another user’s IP address by creating a binding table between client’s IP and MAC address, port, and VLAN.“

 

I will look into it further when I get the time, though as you said I'm just going to leave it for now as it seems to working with the new static IP. Interestingly I tried to set the original IP as static on my windows laptop and got the same results, so at least I know for sure it's definitely something on the switch/network side and not the client.

 

Is there any chance Apples privacy feature on the macbook has changed its MAC address?

 

Thanks, I did look into this but I got the distinct impression that this wasn't a Macbook feature and was only for iPhone & iPad iOS (could be wrong though).

[Koldov]

There's this newfangled automatic thing from that prevents ip mis-configurations and issues like this.

It works by suggesting to a server an address and the server responding with a 'yes' or a different address.

You should try it. It's been well battle tested over the last 30 years.

 

Yeah, I can just imagine how that went...

 

30 years ago...

 

GEEK 1 - "Guys, guys... I've finally invented DHCP! Now you just join a network and get a random IP assigned to your device!

 

30 years ago (and 30 seconds later)...

 

GEEK 2 - "Great, thanks for that... but... um, actually I need to set an IP for these devices that can never change or be given out to another device due to fact we get our reports based on the IP address of the device. Oh and also my last 10 years of code for $software is written based on IPs.... and this device has it's config based on it's IP.... (goes on and on for ten minutes about how certain IPs need to be static).

 

GEEK 1 - "Yeah, but reservations... mutter... lease times... mutter... scavenging... mutter... ARP table...mutter"...

[dmj]

I will look into it further when I get the time, though as you said I'm just going to leave it for now as it seems to working with the new static IP. Interestingly I tried to set the original IP as static on my windows laptop and got the same results, so at least I know for sure it's definitely something on the switch/network side and not the client.

 

Could something else have the IP address and traffic is being routed to that instead?

 

Yeah, I can just imagine how that went...

 

30 years ago...

 

GEEK 1 - "Guys, guys... I've finally invented DHCP! Now you just join a network and get a random IP assigned to your device!

 

30 years ago (and 30 seconds later)...

 

GEEK 2 - "Great, thanks for that... but... um, actually I need to set an IP for these devices that can never change or be given out to another device due to fact we get our reports based on the IP address of the device. Oh and also my last 10 years of code for $software is written based on IPs.... and this device has it's config based on it's IP.... (goes on and on for ten minutes about how certain IPs need to be static).

 

GEEK 1 - "Yeah, but reservations... mutter... lease times... mutter... scavenging... mutter... ARP table...mutter"...

 

yeah, sorry for being facetious. I couldn't resist.

[Koldov]

I’m assuming there’s no CCTV engineers etc. been on site recently that could have set a static IP on a camera etc. that’s causing an IP conflict?

 

Could something else have the IP address and traffic is being routed to that instead?

 

OMG! I found it...

 

I could just go really quiet now and never darken the doorstep of this incredibly stupid thread ever again.... but...

 

A while ago I was having an issue because I dropped all the iPads off the network and had to fire up the old Apple Mac Mini to allow internet connection sharing so they'd all get their new profile. It turns out I had set a static IP on the Wi-Fi (but never used it over Wi-Fi - just because I could I guess)... well that static IP is the very same one... just fired up Advanced IP Scanner and first hit on the Admin Wi-Fi network was "macOS Server (Apache httpd 2.4.34 (Unix) LibreSSL/2.5.5)". What I can't work out is why it only caused a problem last Friday afternoon....

 

yeah, sorry for being facetious. I couldn't resist.

 

It's OK... I have a feeling I shouldn't even be running a network anyway with such limited knowledge, never really sure why I got the job in the first place! honestly, I'm dangerous... always messing something up.

[Davit2005]

OMG! I found it...

 

I could just go really quiet now and never darken the doorstep of this incredibly stupid thread ever again.... but...

 

A while ago I was having an issue because I dropped all the iPads off the network and had to fire up the old Apple Mac Mini to allow internet connection sharing so they'd all get their new profile. It turns out I had set a static IP on the Wi-Fi (but never used it over Wi-Fi - just because I could I guess)... well that static IP is the very same one... just fired up Advanced IP Scanner and first hit on the Admin Wi-Fi network was "macOS Server (Apache httpd 2.4.34 (Unix) LibreSSL/2.5.5)". What I can't work out is why it only caused a problem last Friday afternoon....

 

 

 

It's OK... I have a feeling I shouldn't even be running a network anyway with such limited knowledge, never really sure why I got the job in the first place! honestly, I'm dangerous... always messing something up.

 

If its not us it's our users, lol. Glad you found the issue.

[Koldov]

I mean... I guess I could say if the user in question didn't insist on using a Macbook, then I wouldn't have had to set up a VM to run SIMS and then I wouldn't have had to set a static IP so that I could open up only that IP in the Firewall, so that they could use the Remote Desktop app to connect to it...

 

But yeah, still me this time...

Edited May 14, 2024 by Koldov

[psydii]

There's this newfangled automatic thing from that prevents ip mis-configurations and issues like this.

It works by suggesting to a server an address and the server responding with a 'yes' or a different address.

You should try it. It's been well battle tested over the last 30 years.

 

A current Microsoft documentation page lists Microsoft LAN Manager Client version 2.2c for MS-DOS as an example of a DHCP client.

[ToyHeartsFan]

Oh the joys of 10Mb networking with coax cable...

[ToyHeartsFan]

The school I was at used an external council approved CCTV company who were given carte Blanche to do as they pleased by the Business Manager without any input from me.

 

One of their tricks was to wire a new CCTV camera in to the back of an existing network socket so they didn’t have to run the cable all the way to the comms cab...

 

Another was setting static IP’s on the cams that were within our DHCP lease scope so they caused IP conflicts…

 

I had to figure out the MAC address of all the cams and make reservations, we had 4 NVRS and dozens of cams and the CCTV company refused to give me the login details for the individual cameras so I could check the settings because they had used the same login details at every school...

 

 

 

PS its time SIMS died even CAPITA had enough of SIMS and got rid of it. I’m not sure what was worse managing a local install or dealing with the problems when the business manager decided to move to the hosted version.

[Davit2005]

We've had contractors plug in personal routers and a academic who thought he would be smart and plug in a home router, took us about 2 weeks as the problems were very intermittent and he'd used the same range that was normally given to that building adding to the confusion. We found it by getting a PC that had the issue finding the DHCP server IP address and used ARP to get MAC address and then scouring a 3 floor building for the port and found the router we were not amused

 

We then rolled out DHCP snooping to all edge switches.

Edited May 15, 2024 by Davit2005

[ToyHeartsFan]

The mind boggles as to why they would take in their own router...

 

SLT did once arrange a loan / demo of a portable SMART board from an academy; I had to tell the visiting academy trust that NO they weren't leaving their shiny SMART board on site with a 4G dongle that bypassed the schools filtering... You would think an academy would take safeguarding seriously not try to bypass the schools filtering...

 

I connected the Smartboard to our network, SLT then leased it not that any of the teachers ever used it; we were a Promethean school with an interactive board in every classroom and all the teachers flips were in ActivInspire...

[Davit2005]

The mind boggles as to why they would take in their own router...

 

SLT did once arrange a loan / demo of a portable SMART board from an academy; I had to tell the visiting academy trust that NO they weren't leaving their shiny SMART board on site with a 4G dongle that bypassed the schools filtering... You would think an academy would take safeguarding seriously not try to bypass the schools filtering...

 

I connected the Smartboard to our network, SLT then leased it not that any of the teachers ever used it; we were a Promethean school with an interactive board in every classroom and all the teachers flips were in ActivInspire...

 

Yep, we've had AV devices that become DHCP servers if they don't get an IP address via DHCP too. We rely on reservations quite a bit and very few networks have open DHCP ranges.