Issue with Cameras Picking IPs from Unknown Subnet (192.168.3.X) on Cisco Meraki Network

[Alic-Antunez]

Hi everyone,

I'm managing a small network using Cisco Meraki, and I've run into a strange issue. We have CCTV cameras connected to an NVR, all configured on VLAN 21 (10.20.30.0/26). Switchports connected to the cameras are set to VLAN 21 in access mode.

However, the cameras are somehow picking IPs from a 192.168.3.X subnet, which doesn't exist in my network configuration. I've ensured that all DHCP servers are blocked except for the Meraki MX67 appliance.

After capturing packets, I noticed traffic like 192.168.3.14 communicating with 239.255.255.250 on port 1900 (SSDP). I know this is used for AXIS Camera Station discovery, but I’m puzzled as to where this mysterious 192.168.3.X subnet is coming from.

Does anyone have insights into why this might be happening or how to troubleshoot further? Any recommendations would be greatly appreciated!

__PRESENT

__PRESENT

__PRESENT

[Ryan_Miles]

Is this a single MX or HA config? If HA be aware the LAN uses a virtual MAC and not the base chassis MAC. If you're blocking all DHCP, but the primary MX MAC you'll be blocking legit DHCP traffic to the cc:03:d9:xx:xx:xx virtual MAC.

https://documentation.meraki.com/MX/Deployment_Guides/MX_Warm_Spare_-_High_Availability_Pair#Virtual... 

[AmitPanchal]

Try connecting the laptop to the same camera port and check what IP it is getting. If it is getting the same 192.168.3.X series IP then on the laptop you will get the DHCP server details through which you could identify which DHCP server/system is creating the issue.

[rhbirkelund]

Is it a third party supplier that has been installing the CCTV cameras? In my experience, these third parties tend to either configure the NVR to hand out DHCP addresses to their cameras or that the cameras are statically configured with an IP address. They also tend to supply their own unmanaged swtiching infrastructure. which they uplink the camearas to, which may also be connected upstream to the rest of the network infrastructure.

[PhilipDAth]

This will be the problem.