Всем доброго времени суток!
Уже пару дней бьюсь не могу понять в чем трабла

есть вот такое устройство с таким конфигом

<code>
Building configuration...

Current configuration : 6299 bytes
!
! Last configuration change at 17:41:35 EKB Wed Feb 19 2014 by admin
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
service internal
!
hostname ekaterinburg_gw
!
boot-start-marker
boot-end-marker
!
!
logging buffered 51200 warnings
!
aaa new-model
!
!
!
!
!
!
!
aaa session-id common
clock timezone EKB 6 0
!
crypto pki trustpoint TP-self-signed-2507433426
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-2507433426
revocation-check none
rsakeypair TP-self-signed-2507433426
!
!
ip cef
!
!
!
!
!
!
!
ip dhcp excluded-address 192.168.103.1
!
ip dhcp pool LAN
network 192.168.103.0 255.255.255.0
default-router 192.168.103.1
domain-name antiviruspro.com
dns-server 192.168.0.1 192.168.0.7
!
ip dhcp pool IP-PHONE1
host 192.168.103.21 255.255.255.0
client-identifier 0000.0413.7478.c9
client-name ip-phone1
default-router 192.168.103.1
dns-server 8.8.8.8
lease infinite
!
ip dhcp pool IP-PHONE2
host 192.168.103.22 255.255.255.0
client-identifier 0004.1374.77d9
client-name ip-phone2
default-router 192.168.103.1
dns-server 8.8.8.8
lease infinite
!
!
!
no ip domain lookup
ip domain name antiviruspro.com
ip inspect WAAS flush-timeout 10
ip inspect name DEFAULT sip
ip inspect name DEFAULT sip-tls
ip inspect name DEFAULT tcp
ip inspect name DEFAULT ftp
ip inspect name DEFAULT udp
no ipv6 cef
!
!
vpdn enable
!
vpdn-group 1
request-dialin
  protocol pptp
  rotary-group 1
initiate-to ip 10.10.4.1
!
license udi pid C881W-E-K9 sn
!
!
!
spanning-tree vlan 103 priority 0
vtp version 2
username admin password 7 pass
!
!
!
!
!
lldp run
!
!
crypto isakmp policy 120
encr 3des
authentication pre-share
group 2
!
crypto isakmp policy 130
encr 3des
authentication pre-share
crypto isakmp key key address y.y.y.y  no-xauth
crypto isakmp key key address w.w.w.w no-xauth
!
!
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
mode tunnel
!
!
!
crypto map HEAD-Office 1 ipsec-isakmp
description Tunnel to Head Office
set peer y.y.y.y
set transform-set ESP-3DES-SHA
match address HEAD-OFFICE
!
crypto map TEST 1 ipsec-isakmp
description TEST ipsec
set peer w.w.w.w
set transform-set ESP-3DES-SHA
match address IPSEC-TEST
!
!
!
!
!
interface FastEthernet0
switchport access vlan 103
no ip address
spanning-tree portfast
!        
interface FastEthernet1
switchport access vlan 103
no ip address
spanning-tree portfast
!
interface FastEthernet2
switchport access vlan 103
no ip address
spanning-tree portfast
!
interface FastEthernet3
switchport access vlan 103
no ip address
spanning-tree portfast
!
interface FastEthernet4
description INTERNET ISP
ip address 10.10.4.164 255.255.255.0
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
no lldp transmit
no cdp enable
!
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
switchport mode trunk
no ip address
!
interface wlan-ap0
description Service module interface to manage the embedded AP
ip unnumbered Vlan103
!
interface Vlan1
no ip address
shutdown
!
interface Vlan103
description LAN
ip address 192.168.103.1 255.255.255.0
ip nat inside
ip inspect DEFAULT in
ip virtual-reassembly in
ip tcp adjust-mss 1452
!
interface Dialer1
description PPTP ISP
mtu 1450
ip address x.x.x.x 255.255.255.252
ip pim dense-mode
ip nat outside
ip virtual-reassembly in
encapsulation ppp
dialer in-band
dialer idle-timeout 0
dialer string 1
dialer vpdn
dialer-group 1
no peer neighbor-route
ppp chap hostname user
ppp chap password 7 password
no cdp enable
crypto map HEAD-Office
!
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
!
ip nat inside source route-map NONAT interface Dialer1 overload
ip route 0.0.0.0 0.0.0.0 Dialer1
!
ip access-list extended HEAD-OFFICE
permit ip 192.168.103.0 0.0.0.255 192.168.0.0 0.0.0.255
permit ip 192.168.103.0 0.0.0.255 192.168.80.0 0.0.3.255
ip access-list extended IPSEC-TEST
permit ip 192.168.103.0 0.0.0.255 host w.w.w.w
ip access-list extended LAN-NAT
deny   ip 192.168.103.0 0.0.0.255 192.168.0.0 0.0.0.255
deny   ip 192.168.103.0 0.0.0.255 192.168.80.0 0.0.3.255
permit ip 192.168.103.0 0.0.0.255 any
!
dialer-list 1 protocol ip permit
!
route-map NONAT permit 10
match ip address LAN-NAT
!
!
!
!
!
line con 0
no modem enable
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
stopbits 1
line vty 0 4
privilege level 15
transport input telnet ssh
line vty 5 15
privilege level 15
transport input telnet ssh
!
scheduler allocate 20000 1000
!
end

Building configuration...

Current configuration : 1956 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname ap
!
logging rate-limit console 9
enable secret 5 pass
!
no aaa new-model
!
!
dot11 syslog
!
dot11 ssid EKB
   vlan 103
   authentication open
   authentication key-management wpa
   guest-mode
   wpa-psk ascii 0 key12345678
!
!
!
username cisco privilege 15 secret 5 pass
username admin privilege 15 secret 5 pass
!
!
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
encryption vlan 103 mode ciphers aes-ccm tkip
!
ssid EKB
!
antenna gain 0
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface Dot11Radio0.103
encapsulation dot1Q 103
no ip route-cache
bridge-group 130
bridge-group 130 subscriber-loop-control
bridge-group 130 block-unknown-source
no bridge-group 130 source-learning
no bridge-group 130 unicast-flooding
bridge-group 130 spanning-disabled
!
interface GigabitEthernet0
description the embedded AP GigabitEthernet 0 is an internal interface connecting AP with the host router
no ip address
no ip route-cache
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
!
interface GigabitEthernet0.130
encapsulation dot1Q 130
no ip route-cache
bridge-group 130
no bridge-group 130 source-learning
bridge-group 130 spanning-disabled
!
interface BVI1
no ip address
no ip route-cache
!
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
bridge 1 route ip
!
!
!
line con 0
privilege level 15
login local
no activation-character
line vty 0 4
login local
!
cns dhcp
end

</code>

Вроде все сделано по документации и как положено
НО
Сеть wifi находится устройствами но вот при подключении не получают адреса от dhcp сервера
По меди все норм, устройства получают адреса, но вот зарезервированные адреса не выдаются нужным устройствам. Может стоит обновить прошивку? или реально где-то строчку забыл?
Помогите, может свежим взглядом кто посмотрит, или наоборот, более опытным
Заранее спасибо!