We're in the process of migrating our user access over to Cisco SDA using ISE for authentication and VLAN assignment. For user endpoints, we require that they pass 802.1x initially, which puts them in a limited access VLAN (and no East-West), and then to pass posture with Secure Client (FKA AnyConnect) before being put in the regular user VLAN with full access.
Recently, we've had an issue crop up where machines seem to consistently fail to install the DNS servers included in the lease when moving from the limited VLAN to the user VLAN. It's not that they don't pick up a new lease, they get an appropriate IP address, subnet mask, and gateway, but they just don't seem to configure the DNS IPs, which we've confirmed in PCAPs are included in the Offer/ACK messages from the DHCP server. Instead, a machine that's running into this will just list the IPv6 site local DNS addresses (fec0:0:0:ffff::1%1, fec0:0:0:ffff::2%1, and fec0:0:0:ffff::3%1). Obviously with no DNS, the machine appears to effectively have no network access. Running an ipconfig /renew (no release necessary) seems to consistently fix the problem.
Has anyone encountered anything like this before? Thus far we've only had reports/been able to reproduce this on Windows. I have a case open with Cisco, but they didn't see anything within our ISE configs (e.g. Secure Client agent config, AuthZ policies, etc.) that would suggest ISE is causing the issue. The fact that the lease messages from the DHCP server contain the DNS servers in option 6 suggests to me that it's more of an endpoint-centric problem, but I'm stumped as to why the endpoint would receive those options and just…ignore them.
Source: r/networking · by /u/AlmavivaConte