So: I'm in charge of a 1:1 iPad deployment at a school. We've just finished reconfiguring our network with a new firewall, router, and some updated L3 logic. My MacBooks are working great, PCs are working great, all devices are working great both wired and wireless. EXCEPT iPads. Somehow my iPads are requesting addresses on my management VLAN, which does not / should not give out addresses. My switch ports are set to management untagged, internal VLAN and guest VLAN tagged. The APs have a management IP statically assigned, internal and guest VLANs defined, and VLANs are associated with the SSIDs. There is no untagged SSID. A Native Route VLAN and Native (untagged) VLAN is not defined on the APs. Our new Cisco ASA has a DHCP Relay defined to send requests to our central DHCP server. My DHCP server has scopes defined for internal and guest. I have not configured IP-Helper on our HP ProCurve core switch, but just received advice that maybe I should. So — on literally the same SSID, sitting right next to each other, my iPhone gets an IP properly and my iPad does not. Both iOS 9.3.4. On my DHCP server, I can see the request from the iPad coming in on the management subnet, and of course it doesn't have any leases available on that subnet so denies the request. How in the actual f- could this be happening? I've even tried a factory restore on the iPads — so wifi profiles aren't even installed at that point — with no luck.