Guest Wireless Weirdness

deanwebb · December 13, 2016, 08:53:52 PM

Clients in location Alpha cannot use guest wireless... well, they can reach sites by IP address, but not URL. Unless they have a cookie that caches the IP of the URL. And some IP addresses work for some clients there, but not others.

At site Beta, we set up an AP to connect to the WLC in Alpha and use the same CAPWAP tunnel to the WLC in the DMZ at location HQ... And clients at location HQ also can't use guest wireless!

Everything in site Beta works just fine.

What is going on? The clients in Alpha and Beta are in the same subnet and have the same inbound/outbound firewall rules and use the same DMZ WLC...

SimonV · December 14, 2016, 05:47:48 AM

What sort of authentication do you have on these guest networks? Is this before or after auth?

It's probably the firewall though.

wintermute000 · December 14, 2016, 06:03:01 AM

Mtu?

Nerm · December 14, 2016, 09:12:10 AM

Just to clarify that I understand the question correctly. You have two sites and guest users at one site work fine but guest users at another are reaching sites by IP but not resolving DNS?

Otanx · December 14, 2016, 10:18:55 AM

Assuming site A and B have different subnets is the DNS server allowing lookups from the site A space?

-Otanx

deanwebb · December 14, 2016, 11:03:23 AM

Quote from: Nerm on December 14, 2016, 09:12:10 AM
Just to clarify that I understand the question correctly. You have two sites and guest users at one site work fine but guest users at another are reaching sites by IP but not resolving DNS?

More like, whoever is connected to the lucky test AP we have, regardless of what WLC it's associated with, gets full Internet. Connect to some other AP associated with that WLC? Most of your IP addresses will work, although some failed. No DNS works, unless it's a cached entry or a cookie has an IP address in it.

Vendors that somehow manage to set up a VPN through the guest wireless can get full Internet, but it's because their Internet is now going through their vendor's network.

The subnet itself is a massive /19 that's available all over the Americas. It's the *regional* guest wireless solution. It's for HQ, as well as sites A-Z.

I'm very curious how the troubleshooting in Brazil went this morning, but I'm taking a sick day because my eye is starting to twitch bad after too much stress at work. Twitching should be manageable by tomorrow, so I'll see if they have a solution by then.

icecream-guy · December 14, 2016, 11:30:33 AM

probably simple issue like an incongruous netmask typo in a ACL, e.g. 255.252.255.0 or something like that .

deanwebb · December 14, 2016, 12:17:45 PM

Quote from: ristau5741 on December 14, 2016, 11:30:33 AM
probably simple issue like an incongruous netmask typo in a ACL, e.g. 255.252.255.0 or something like that .

That thought did occur to me... I joked at one point that only odd-numbered IP addresses were being allowed out.

My biggest beef was that nobody collected enough data to determine if it was all, most, or some of the people at a site having issues and nobody followed up to check proactively at other sites to see if they had the same problem or if all was well with them. By the time it got escalated to me late in the day, people were already on their way home, so we were limited in our testing.

And when our testing failed to reproduce the error, we were all like...

We didn't even have the guy that did the maintenance on the guest wireless connection over the weekend so we could ask him...

Because the same maintenance was done in two regional guest wireless configs, and they're both working just fine.

I know, it's a mess. I feel like either EVERYTHING should be broken or nothing should be broken... instead, it seems to be random, and only in the Americas, not EMEA or APAC.

Nerm · December 14, 2016, 03:09:29 PM

So what config/whatever differences are there between the "working" test AP and existing setup AP's?

deanwebb · December 14, 2016, 04:41:39 PM

Quote from: Nerm on December 14, 2016, 03:09:29 PM
So what config/whatever differences are there between the "working" test AP and existing setup AP's?

I don't think there were any... pretty much, here's your IP, welcome to the wireless network. Corporate SSIDs worked just fine through the same APs.

I'll know more about this when I get back to work tomorrow.

deanwebb · December 15, 2016, 08:31:25 AM

The guys managing the perimeter security put the IPS on the Internet connection into Layer 2 fallback mode and that cleared things up.

Before that, they guys in India set up a test AP and had excellent results.

Now I want to know why it is that the IPS only affected *some* of the traffic and not *all* of it, discriminating, it seems, based upon usage of DNS and AP placement...