SOLVED: Can't connect to standalone 1142

phoeneous

First time setting up a standalone 1142, can't get any clients to connect to it. On an xp laptop, hangs at acquiring network address for about 20 seconds then fails then gets apipa address. Using vlan 40 for wifi traffic. Switchport is trunking and shows vlan 40. I'm able to ping the internet gateway's .40 subinterface from the ap and vice versa. AP is handling dhcp. AP should be using WPA2 psk. See scrubbed config below, any help is appreciated.

1142#sh run
Building configuration...
Current configuration : 4534 bytes
!
version 12.4
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname 1142
!
!
no aaa new-model
ip domain name company.com
ip name-server 172.18.80.1
no ip dhcp use vrf connected
ip dhcp excluded-address 172.18.84.1 172.18.84.99
ip dhcp excluded-address 172.18.84.201 172.18.84.255
!
ip dhcp pool ***COMPANY_WIFI***
network 172.18.84.0 255.255.255.0
default-router 172.18.84.1
dns-server 172.18.80.1
domain-name company.com
!
!
login on-failure
login on-success
dot11 syslog
!
dot11 ssid TEST
vlan 40
authentication open
authentication key-management wpa version 2
mbssid guest-mode
wpa-psk ascii 7 blahblahblah
!
!
crypto pki trustpoint TP-self-signed-84115847
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-84115847
revocation-check none
rsakeypair TP-self-signed-84115847
!
!
!
!
ip ssh version 2
bridge irb
!
!
interface Dot11Radio0
no ip address
no ip route-cache
!
encryption vlan 40 mode ciphers aes-ccm
!
ssid TEST
!
antenna gain 0
mbssid
station-role root
bridge-group 1
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface Dot11Radio0.40
encapsulation dot1Q 40
no ip route-cache
bridge-group 40
bridge-group 40 subscriber-loop-control
bridge-group 40 block-unknown-source
no bridge-group 40 source-learning
no bridge-group 40 unicast-flooding
bridge-group 40 spanning-disabled
!
interface Dot11Radio1
no ip address
no ip route-cache
shutdown
antenna gain 0
dfs band 3 block
channel dfs
station-role root
bridge-group 1
bridge-group 1 subscriber-loop-control
bridge-group 1 block-unknown-source
no bridge-group 1 source-learning
no bridge-group 1 unicast-flooding
bridge-group 1 spanning-disabled
!
interface GigabitEthernet0
no ip address
no ip route-cache
duplex auto
speed auto
no keepalive
bridge-group 1
no bridge-group 1 source-learning
bridge-group 1 spanning-disabled
!
interface GigabitEthernet0.40
encapsulation dot1Q 40
no ip route-cache
bridge-group 40
no bridge-group 40 source-learning
bridge-group 40 spanning-disabled
!
interface BVI1
ip address 172.18.84.10 255.255.255.0
no ip route-cache
!
ip default-gateway 172.18.84.1
no ip http server
ip http authentication local
ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
bridge 1 route ip
!
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
login local
line vty 0 4
privilege level 15
logging synchronous
login local
transport input telnet ssh
line vty 5 15
privilege level 15
logging synchronous
login local
transport input telnet ssh
!
end
1142#

phoeneous

Just figured it out, forgot to add encap dot1q 40 native to all my subinterfaces...