Define wireless guest network

  • 1
  • Question
  • Updated 3 years ago
Hello, we have created one SSID with user profile and dhcp server for wireless guest network. The two AP121 have manual ip address from our internal network.
The network policy is the same as this picture : https://d2r1vs3d9006ap.cloudfront.net/s3_images/1113752/RackMultipart20141028-27616-11412ci-ScreenShot2014-10-28at1.24.35PM.png

Any iPhone or Android get ip from dhcp (192.168.77.x  > vlan 77) but can't access internet.
what should we check ? Thank you for assistance.

Regards.
Photo of L-inf

L-inf

  • 12 Posts
  • 0 Reply Likes
  • confused

Posted 3 years ago

  • 1
Photo of Bill W.

Bill W.

  • 222 Posts
  • 35 Reply Likes

That's the IP Firewall Policy, not the Network Policy. You need to also provide a screenshot of the user profile that you are using with the Firewalls setting expanded to help see what is going on.

Also, are you sure your network is properly configured so that subnet can access the Internet? An easy way to check your config to see if it should work is to remove the IP firewall policy from the user profile and see if they can then access the Internet. If they can, you know the network is setup correctly. Then it's back to making sure you applied the firewall policy correctly.

Photo of L-inf

L-inf

  • 12 Posts
  • 0 Reply Likes
Hi,

AP logs are showing errors like this :

2015-11-04 18:35:30 info    kernel: [fe]: IP session (id 140) 192.168.77.10/60369 -> 8.8.8.8/53, proto 17 is invalidated, reason ageout, lifetime 1 min 6 sec, user-name N/A
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
Why have you concluded that a point of information that something is ageing out is necessarily an error?

It refers to DNS. Is nslookup working for you on a client?
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
You need to follow Bill W's suggestion to start to triage this.

Cheers,

Nick
(Edited)
Photo of L-inf

L-inf

  • 12 Posts
  • 0 Reply Likes
I thaught this event was referring to the dns problem (nslookup is not working, even with firewall disabled and wireless clients can't ping the gateway 192.168.77.254 on dhcp interface mgt0.1)
(Edited)
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
As you've turned off the firewall and it still is not working...

Check that DHCP is completing successfully and is supplying the right information to clients, that is that you're seeing an expected IP address, subnet mask, default gateway and DNS server(s).

Can you ping the IP address of the default gateway?
(Edited)
Photo of L-inf

L-inf

  • 12 Posts
  • 0 Reply Likes
Dhcp informations are good on iPad for example (ip, subnet mask, gateway, google dns...)
I can ping the ip of the interface mgt0.1 (192.168.77.1) but not the defined gateway on dhcp options (192.168.77.254)
(Edited)
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
Hang on a sec, you are using VLANs so why is the AP's management IP address in the same range as your guest VLAN?

The management address of the AP should be in a different, isolated VLAN to your guest traffic.

I suggest that you take a step back and look at your VLAN and subnet design and make sure it makes sense before you go further.
Photo of L-inf

L-inf

  • 12 Posts
  • 0 Reply Likes
The DHCP server has been setup following this link : https://community.aerohive.com/aerohive/topics/proper_dhcp_setup

The two AP121 have manual ip address from our internal network (each one has own management ip on mgt0 interface) and dhcp server is set on mgt0.1 interface
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
Ah, makes sense! Sorry, I was busy doing something else when I wrote that and did not think this through properly. For some reason, I did not comprehend you were using the AP as the DHCP server. My bad, I need to pay more attention!

I think that you need to work out why your default gateway is unreachable in that VLAN from the APs perspective when it sends tagged frames for VLAN 77, so check the VLAN configuration on the wired infrastructure and there's a routed interface available. I think you will find your problem lies there.

Have you tried the VLAN probe feature?

http://boundless.aerohive.com/blog/its-not-a-wi-fi-problem--use-vlan-probe-to-troubleshoot-the-wired...
Photo of L-inf

L-inf

  • 12 Posts
  • 0 Reply Likes
Yes, I used the VLAN robe, and VLAN 88 is available on both AP. To make it simple, there is another SSID on those AP (with VLAN 12). The guest SSIS uses DHCP with VLAN ID 88. So this one has to be decalred on internal network ? Its choice is not arbitrary ?
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
You need an IP interface in the VLAN, how else is it going to get out to the Internet?
(Edited)
Photo of L-inf

L-inf

  • 12 Posts
  • 0 Reply Likes
Hello,

VLAN 88 has been set on our internal network. Internet access is ok !

Best regards
Photo of L-inf

L-inf

  • 12 Posts
  • 0 Reply Likes
Hello, we created in the same way new SSID with new VLAN and dhcp server. From AP device we can ping ip address of the new dhcp server, but the gateway (aka the core switch) is not accessible  :/  Thank you for any suggestions.
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
Does the core switch have an IP interface in this VLAN?
Photo of L-inf

L-inf

  • 12 Posts
  • 0 Reply Likes
Yes exactly. So as the first VLAN.
The VLAN Probe test is showing that the new vlan is available.
(Edited)
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
Have you checked that the VLAN is passed through exposed to the AP, that all the port configuration is correct? You may find the VLAN probe tool useful: http://boundless.aerohive.com/blog/its-not-a-wi-fi-problem--use-vlan-probe-to-troubleshoot-the-wired...
Photo of L-inf

L-inf

  • 12 Posts
  • 0 Reply Likes
The VLAN Probe test is showing that the new vlan is available  :)
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
Sorry, I missed that line.

I would check the ARP table to see if the expected default gateway is asserted as being available in that L2 broadcast domain. If not, you have a L2 issue that you need to resolve.

Then, can you ping the address of the default gateway? If so, any problem using the default gateway is likely to be with the core switch itself where that IP interface is defined.

Follow your problem through logically and you'll find the cause.
(Edited)
Photo of L-inf

L-inf

  • 12 Posts
  • 0 Reply Likes
On the Cisco core switch, the default gateway (192.168.99.254) is responding.

And show arp shows :

Internet  192.168.99.1            0   Incomplete      ARPA   (and interface detail has non vlan)

(192.168.99.1   is the ip address of the mgt0.2 interface of new dhcp server)


For example on the working vlan :

Internet  192.168.77.1           21   e01c.41bc.2040  ARPA   Vlan77
Photo of Nick Lowe

Nick Lowe, Official Rep

  • 2491 Posts
  • 451 Reply Likes
Right, so the interface doesn't look to be present in that VLAN.
Photo of L-inf

L-inf

  • 12 Posts
  • 0 Reply Likes
indeed, a vlan trunk was missing on the switch. The gateway is responding, vlan works fine.
Thank you  :)