Hoping to get some insight regarding a bizarre issue that is being seen at a few of our networks, as well as others (based off reddit and NANOG posts). The short story of what is happening is that Apple devices (primarily MacBooks as well as some iMacs) that are sleeping will hijack the default gateway IP for the wireless VLAN that they are in, as well as responding to ARP requests asking who the default gateway is. This behavior makes the AP's log a message "CAPWAP detected next hop MAC changed from correct_DG_mac_address to apple_mac_address."
We have tickets open with Cisco who is blaming Apple, and Apple who is stating we need logs that are utterly impossible to get as we cannot recreate this behavior. Apples current workaround? Push out a script to completely disable sleep on all Apple devices.
This is only affecting 3802i WAPs that are in flexconnect mode, and we are seeing this at multiple sites, on two different wireless controllers. The 3802i's do not reboot - they lose connectivity, recover, repeat.
Wireless subnets are generally as large as /20 and contain the AP's as well as all clients. We plan to move AP's to a different subnet as a test, but we are hesitant due to the fact that if AP's no longer log the CAPWAP message/drop from Prime - then we will not know when this behavior occurs making it harder to track.
The ARP entry on the switches NEVER changes. For this reason, I believe DAI/DHCP snooping would not be an effective solution as I've seen others suggest.
We think this behavior may be related to sleep proxy that can we seen with out of the box Apple TV's, but have yet to prove that.
My question is - has anyone ran into this type of behavior before. In addition, does anyone have any suggestions as far as how to remedy this behavior so it no longer occurs?