"No internet access" on Guest Wifi

We upgraded our router the other day, we made a backup as well as a txt copy of the config file for copying in various commands to the new router .
We have a Secure wifi for employees and a Guest wifi for visitors. We have a server doing the DHCP(10.27.131.8) for both the secure (10.27.131.0 network) and for the Guest (10.26.131.0 network). The Secure wifi is working as it should be - the Guest however is not. Visitors can connect and get a valid IP address from the 10.26.131.0 network but have no internet access. Everything else has stayed the same - no changes to the AP's.
Again we copied the config from the old to the new with a few minor changes but nothing that should effect the Guest wifi.
I did an ipconfig after connecting to the Guest Wifi and I can get a correct IP address 10.26.131.214, Default GW: 10.26.131.1.
I enclosed the config from my router is anybody could shed some light,
Thanks in advance.
Building configuration...
aaa new-model
aaa authentication login default line local
aaa authentication login vtymethod group tacacs+ line
aaa authentication login conmethod line
aaa authentication login httpmethod group tacacs+ local
aaa authentication enable default enable group tacacs+
aaa authentication ppp default none
aaa authorization config-commands
aaa authorization exec default local group tacacs+ none
aaa authorization commands 1 default group tacacs+ if-authenticated
aaa authorization commands 15 default group tacacs+ none
aaa accounting exec default start-stop group tacacs+
aaa accounting commands 1 default start-stop group tacacs+
aaa accounting commands 15 default start-stop group tacacs+
aaa accounting network default start-stop group tacacs+
aaa accounting system default start-stop group tacacs+
aaa session-id common
resource policy
ip subnet-zero
ip cef
no ip dhcp use vrf connected
ip dhcp excluded-address 10.26.131.1 10.26.131.100
ip dhcp pool guest
   network 10.26.131.0 255.255.255.0
   dns-server 208.67.222.222 208.67.220.220
   default-router 10.26.131.1
   domain-name guest.X.xxx
interface Tunnel3
ip address 172.17.3.2 255.255.255.0
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source 12.xx.xx.xx
tunnel destination 19x.xx.xx.xx
interface Tunnel55
ip address 192.168.66.10 255.255.255.0
ip accounting output-packets
ip accounting access-violations
ip mtu 1400
ip tcp adjust-mss 1360
tunnel source 12.xx.xx.xx
tunnel destination 12.xx.xx.xx
interface FastEthernet0/0
ip address 12.xx.xx.xx 255.255.255.248
ip nat outside
ip route-cache flow
duplex auto
speed auto
service-policy output physical
interface FastEthernet0/1
description CONNECTION TO SW3
no ip address
duplex auto
speed auto
service-policy output physical
interface FastEthernet0/1.1
description LAN
encapsulation dot1Q 1 native
ip address 10.27.131.254 255.255.255.0
ip flow ingress
ip flow egress
ip nat inside
no snmp trap link-status
interface FastEthernet0/1.20
description GUEST NETWORK
encapsulation dot1Q 20
ip address 10.26.131.1 255.255.255.0
ip access-group 101 in
ip helper-address 10.27.131.8
no snmp trap link-status
interface FastEthernet0/1.200
description Phone VLAN
encapsulation dot1Q 200
ip address 10.5.2.254 255.255.255.0
no snmp trap link-status
interface Serial0/0/0
no ip address
shutdown
interface Serial0/2/0
no ip address
shutdown
interface Serial0/3/0
no ip address
shutdown
ip classless
ip route 0.0.0.0 0.0.0.0 12.xx.xx.xx
ip route 10.5.5.0 255.255.255.0 10.5.2.1
ip route 10.10.0.0 255.255.255.0 172.17.3.5
ip route 10.10.200.0 255.255.255.0 172.17.3.5
ip route 10.25.131.0 255.255.255.0 192.168.66.20
ip route 10.27.129.0 255.255.255.0 172.17.3.5
ip route 10.27.130.0 255.255.255.0 172.17.3.5
ip route 140.xx.xx.xx 255.255.0.0 172.17.3.5
ip route 192.168.2.0 255.255.254.0 172.17.3.5
ip route 192.168.99.0 255.255.255.0 172.17.3.5
ip http server
ip http authentication local
ip http secure-server
ip nat inside source list 2 interface FastEthernet0/0 overload
access-list 2 permit 10.27.131.0 0.0.0.255
access-list 2 permit 10.25.131.0 0.0.0.255
access-list 2 permit 192.168.66.0 0.0.0.255
access-list 2 permit 10.14.0.0 0.0.0.255
access-list 2 permit 10.5.5.0 0.0.0.255
access-list 2 permit 10.5.2.0 0.0.0.255
access-list 5 deny   10.27.131.123
access-list 5 permit 192.168.2.0 0.0.0.255
access-list 5 permit 10.27.131.0 0.0.0.255
access-list 5 permit any
access-list 101 permit tcp any host 10.27.131.8 eq 67
access-list 101 permit udp any host 10.27.131.8 eq bootps
access-list 101 permit ip 10.26.131.0 0.0.0.255 host 10.14.0.6
access-list 101 deny   ip 10.26.131.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 101 deny   ip 10.26.131.0 0.0.0.255 172.16.0.0 0.15.255.255
access-list 101 deny   ip 10.26.131.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 deny   icmp 10.26.131.0 0.0.0.255 172.16.0.0 0.15.255.255
access-list 101 deny   icmp 10.26.131.0 0.0.0.255 10.0.0.0 0.255.255.255
access-list 101 deny   icmp 10.26.131.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 permit ip 10.26.131.0 0.0.0.255 any
access-list 102 permit icmp 10.25.131.0 0.0.0.255 any
access-list 102 permit ip 192.168.66.0 0.0.0.255 any
access-list 102 permit ip 10.25.131.0 0.0.0.255 any
access-list 102 permit ip 10.27.131.0 0.0.0.255 any

Hi,
I also apologize for my late answer.
I appears your ACL 101 that filters traffic entering the Fa0/1.20 is not correctly written to allow DHCP requests to be processed by the router. The attempt has been made - but it is not correct. In particular, check out the second entry in the ACL 101:
access-list 101 permit udp any host 10.27.131.8 eq bootps
It allows all DHCP messages that are already targeted to 10.27.131.8, the DHCP server. However, such targeted DHCP messages may be used by clients only after they know who the DHCP server is in the first place. Until then, the requests are targeted to 255.255.255.255 and sourced from 0.0.0.0. Such packets are not allowed by any entry in the ACL 101 and are therefore dropped even before the DHCP Relay Agent can process them. That would explain why your clients actually cannot obtain IP address via DHCP in VLAN 20.
We need to add the following entry immediately before or after the existing second entry in the ACL 101:
access-list 101 permit udp any host 255.255.255.255 eq bootps
You may accomplish this by the following sequence of commands directly pasted into the global configuration:
ip access-list resequence 101 10 10
ip access-list extended 101
15 permit udp any host 255.255.255.255 eq bootps
end
The first line will cause the individual entries of the ACL 101 to be internally numbered, starting with the sequence number 10 and incrementing by 10 for each subsequent entry. The second line enters the ACL 101, treating it as a named ACL, allowing us to use the extended editing features. Finally, the third line starting with the sequence number 15 will cause the entry to be added between the existing first (seq no 10) and second (seq no 20) entry. It must be entered including the sequence number, otherwise the line will be added at the end of the ACL.
Would you mind trying out this modification? The former corrections with the NAT I have described earlier must be applied as well.
Best regards,
Peter

Similar Messages

Ethernet cable internet access only No WiFi in hotel MBA user

Am assuming I need to carry my own Airport Express with my MBA as I am in a hotel that has ethernet cable internet access only - no WIFI? If so, what do I need to know about how to get MBA and Airport Express to "talk" to each other in these types of hotel situations?
Thanks for your assistance
PEM

Hi Elegba,
Curious... did you consider the USB Ethernet adapter for the MacBook Air? A whole lot cheaper of a solution for a hotel without WiFi. Not to mention, I've found (after initially struggling to justify the purchase) that I use mine more than I originally thought.
However, to answer your question. You'll connect the Ethernet to the AirPort Express Base Station and configure it via the AirPort Utility on your MacBook Air. It's very straight-forward and you'll be creating a wireless network. You may need to first get setup with your 'in room' connection, though, I know most hotels have a proxy connection for web access. While you should still be able to setup the Express, it's just something to keep in mind.

No internet access via guest network

I have setup up a guest wifi network on time capsule. Guests can connect to the network but the network does not allow them to access the internet?

That would be the issue.
The simplest fix would be to use the wireless on the Netgear for "guests".
Next option would be to ask your provider if they can supply you with a simple modem.....not a modem/router or gateway type of device.
After that.....not recommended.....you could try a different setting on the Time Capsule which would produce an error called Double NAT on the network....that may or may not allow things to work and create other problems as well.

Is it possible to be connected with a 3G modem for internet access and a WiFi router for printer sharing at the same time?

For our only internet access we have a 3G wireless modem. I have since purchased a WiFi printer and router to connect all the comptuters to in the house. The PCs have no problem with using both the 3G connection and the WiFi signal at the same time to print, however, the MacBook Pro will not connect to the 3G network and the router, it will drop the internet access from the modem and attempt to connect via WiFi (which has no internet access). Is there a solution that is available to remedy this? I attempted to create an adhoc printer network, however, the macbooks again will not print off of this, only the PCs. And I'm getting a bit frustrated overall with this.

The 3G wireless modem is on one of the PC's correct?
Why don't you pass the Internet through the Ethernet port to the router via Cat5 cable, then have that transmit a Wifi signal that everything else can use, then connect the printer to the router for print sharing?
You would have to turn off the wifi on the comptuer with the 3G modem as it's physically connected to the router and can't connect to the other machines as they are all connected to the router for sharing.
The Mac has the ability to pass, Internet Sharing in the System Preferences.
Do you have software for the Mac to run the 3G modem?

No internet access Available from wifi

I am very annoyed that i pay for a service and cannot have access to the internet Using wifi.. "no internet connection available"I have tried it on both my Xperia Z2 and Samsung S5 with no luck.. It is that bad that i'd have to say that i can only use it about 2 percent of the times.. YES 2 PERCENT.. not a typo.. This is bloody ridiculous..I have done a lot of research on the net and it seems to be an Android problem.. Spotify works on my PS4, WII and Laptop but on none of my androids.. The mobile is the main reason i joined/suscribed as a premium member..
No point asking me to try to fix it myself as i already..1.. uninstalled/reinstalled software,2... Turned on/off /on the phone,3... Restored both phones,4... Taken both phones to my mate's house Wifi and5...Used the community service you guys offer and still with the same "No internet issue" Please advise real fix for this issue as i am spending my well earned money on a service that i am having extreme difficulty using... You should also have a phone number for direct contact so that WE can contact you and have all our problems/issues fixed 1 on 1.. Awaiting a genuine response

Same here. Have had this problem since the latest updates (latest one has still not fixed it) and there's no solution provided by spotify people anywhere. This is unbelievable. "no Internet connection" when using spotify on wifi, on my nexus 5, nexus 10 and galaxy s3. when going to cellular data it works fine.
FIX THIS, IT'S BEEN A MONTH

Corporate responsibility for logging guest Internet access

Hi all
Can anyone tell me what the requirement is in the uk for logging guest Internet access for guest users at my co
Company ? Is it lawful requirement ?

The following documents lists all the supported Databases,
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/user/d.htm

TS1398 As a truck driver, I don't have internet access, my cell phone doesn't support Apple yet either,,, How can i gain internet access on the road if I'm rolling and not in a stationary place for wifi?

I recently purchased an i pad and have the internet at home, I am also a truck driver and once i leave home, I won't have the internet unless I stop close to where there is wifi, is there anything out there that I can purchase so I will have the internet at all times

I purchased a Verizon MIFI 2200 mobile hotspot with my forst generation iPad almost tow years ago so that I could have internet access with my WiFi only iPad and my iPod Touch. All in all it is pretty reliable but as varjak paw stated above...
"Either of course will be dependening on your being in a location where the carrier provides cell coverage".
Like my cell phone - there are locations where the MIFI doesn't play nice with the cellular networks and it may struggle to find a good signal. On the other hand, sometimes my connection zips along quite nicely. Just keep that in mind - if and when you decide to purchase a mobile hotspot.

Iphone6 touch id stops internet access both wifi and cellular

iPhone 6 64GB iOS 8.0.2 Verizon - With Touch ID on (at least one fingerprint is configured), there are times when I depress HOME to wake the device and then try to use the fingerprint reading service, internet access stops both on wifi and cellular. Turning wifi off and on doesn't help. The wifi signal shows as OK. No subsequent internet access on either wifi or cellular. Have to restart the device (I hold the home and power buttons together until the Apple logo displays).
Right now, it is OK to not use Touch ID. In fact, since I specify how long to wait before locking the device it is actually more convenient to not use Touch ID.
However, when Apple Pay is available this will be a significant problem.
Any advice? Thank you.

I have not verified this, but I have read that the ios 6 ipad uses either the cell network or the wifi network, but not both at the same time.
You should be able to test this.
I'm not enough of a network tech to know if you could get this to work, but there are mifi devices that do wifi to cellular.
Here is one example:
FreedomPop provides 500meg of free 4g cellular data per month! You do need to buy a wireless device at $39. There are ways of getting bonus megs. One gig of addition data costs $10 per month. I used about 10megs per hour of internet surfing.
When signing up, you need to be careful with your selections. On some screens, the free option is a small link below the large button. FreedomPop employs a Pavlovian Dog < Operant conditioning > thing of getting you used to clicking on the large button then they change the large button to a paid add-on.
Once you setup your account, you need to go to your account options screen to turn off automatic paid data download once you exceed your quota.
The performance seems about like my DSL connection.
http://www.freedompop.com/offers.htm?experience=organic.default
http://www.freedompop.com/coverage
Get it before they go broke.
Robert

How would I contain guest Wifi network in firewall?

I would like to implement a guest wifi network on my preexisting private network and can't figure out the security on my firewall. Currently the link connecting my private network to the internet is functioning fine and I really don't want to change this link into a trunk as I believe trying to reconfigure the trunk and security lists in the firewall would cause downtime. I would like to use a second interface on the firewall (5520 ASA with 8.2 software) as a trunk interface for my guest network and any other new VLAN in the future. My main concern is at the Core of my network the default gateway is the private IP for my internal firewall connection. If the guest network is connected to my core device going to the ASA, how do I specify a second default gateway on the core for the guest network on the ASA?
After writing this I realized, what if i connected a switch directly to the second trunk interface on my ASA and then used this IP as the default gateway for the guest network? I believe this should work but this leads me to one more question:
Say I wanted to allow my quest network access to a specific server on my internal network, would a proper configuration be to setup the ACLs on the firewall, allowing them to communicate to my inside network?

Hi,
Yeah I suppose changing the existing interface to a Trunk would not be possible without somekind of downtime unless you used an untypical configuration.
Sadly, my personal knowledge of wireless networks and the devices is almost nonexistent as we have different people to handle setting up those.
But I would imagine you can use a separate Vlan for the Guest Wifi and bring that Vlan to the new ASA interface only. If your actual core switch is doing routing, in other words if its acting as a L3 switch then you should probably add the Guest Wifi Vlan only as L2 to the core switch and configure it all the way to the new ASA Trunk. Default gateway as you say would be the IP address configured on the ASA itself.
Controlling the traffic from the new interface on the ASA should be pretty simple.
access-list GUEST-WIFI remark Allow traffic to internal server
access-list GUEST-WIFI permit tcp host eq
access-list GUEST-WIFI remark Deny All traffic to Internal networks
access-list GUEST-WIFI deny ip any
access-list GUEST-WIFI remark Allow All other traffic
access-list GUEST-WIFI permit ip any
access-group GUEST-WIFI in interface
The above ACL first allows some traffic to a certain internal server with a certain service. It then blocks all other traffic to the internal network. Finally it allows all other traffic. That would be all traffic destined to external public networks.
Naturally you would need possibly Static Identity NAT configurations (since you are using 8.2 software) to enable connections from the Guest Wifi to Internal network.
- Jouni

No internet access through hosted network

I created a hosted network to share the internet enabled the same. Both shared connection and the hosted network are showing 'Access type' as internet access, other guest devices are connected to the hosted network, got ip addresses also. But none of
the devices are able to access internet. I have tried disabling antivirus and firewall, but still the internet connection is not available to other devices.
Tried ‘Virtual router plus’. That also could not help in getting internet access, there in fact the internet connection sharing had to be enabled manually.
I had gone through similar issues, but could not see proper answer from an expert.
OS: Windows 8, Windows Firewall enabled
Antivirus: Trend Micro
Internet: USB modem (ICS enabled for the hosted network).
Any suggestions for resolving this issue would be highly appreciated. Thanks in advance.
PS: I could share internet using the same USB modem with a machine running Windows 7 using similar method.

Hi,
Refer to this tutorial:
How to share internet from Windows 8 computer via WiFi without using Router
http://gallery.technet.microsoft.com/How-to-share-internet-from-ab8d6d35
if this issue persists, try to see if there is newest network driver for windows 8.
Alex Zhao
TechNet Community Support

Can I create a wi-fi network on my macbook and still connect to the internet via an actual wifi point?

Hi,
I got TrakProDJ from the app store and installed it.
It allows me to control a DJing software with my iPad by setting up a network via Wifi Symbol in Toolbar>Create Network...
The problem with this is the network I create isn't based in the internet--it's just a wifi link between my laptop and iPad.
I'm sure I'll get asked to play songs I'll have to look up on youtube, so how is it possible that I can maintain my wifi network connection on my macbook and create an access point for my iPad to use to communicate with my laptop (to control the DJing software)?
I'll really appreciate any help I can get!
Thank you!

You cannot use both an ad-hoc network and a normal ap based one with any wireless device. Your only solution is to use a wired Internet connection to do so on the laptop, that way you use that for Internet access and your wifi for the ad-hoc network the app requires. You might want to contact the developer of that app and find out why they limit the setup to just an ad-hoc wifi setup. Seems that if all it requires is just a network connection to the laptop, they could simply use any existing network connection as long as both devices can see each other on it. Either that or also give the user the option to use Bluetooth for it if they have the higher version of hardware to support the necessary data exchange.

Guest Internet access in the Enterprise

We have set up guest internet access in our enterprise using GRE tunneling with a PIX. I'm trying to determine the best way to do authentication for users on this guest network.
I think I can do RADIUS (using ACS) with the PIX as an NAS. Question is can I use a different type of server (such as MS IAS)? Can I use either one to utilize an existing MS Active Directory database?
If I use radius on the pix for authentication, a login prompt pops up when a user tries to use the web. Is there a way to redirect users to a web page first and have the login embedded on the page? This is done in hotels now and I don't know if there's a Cisco solution for this.

The following documents lists all the supported Databases,
http://www.cisco.com/univercd/cc/td/doc/product/access/acs_soft/csacs4nt/acs33/user/d.htm

I don't have a DSL or cable modem to access the Internet ... just a mobile WiFi (there is no cable available at our house). How do I connect my Time Capsule to the Internet via the mobile WiFi?

I don't have a DSL or cable modem to access the Internet ... just a mobile WiFi (there is no cable available at our house and the mobile WiFi is our only option). How do I connect my Time Capsule to the Internet via the mobile WiFi?

LOL!!
I am in Australia and the ISP... I think both the main ones would fit your description to a T.. big T in particular.
Your router is really unsuitable.. if it is only wireless and no ethernet.. just buy an ethernet one.
Do a search on ebay.. 3g router.
But you can get the TC to join a wireless network.
It is a non-standard setup that Apple will not support.. the option is hidden.
If you are on Lion download the 5.6 utility. Go to the wireless set up page and hold down the option key whilst selecting wireless mode.. a new option, join will appear. You can then put in the ssid and passkey of the 3g router.
But please note the end result of this setup..
very slow speed. The TC is now a second wireless hop from your clients.. this will halve the speed.
In this mode the ethernet are deactived.. for reasons only Apple know, they decided you should not use ethernet when doing this.

How-do-i-configure-guest-wifi-access-using-2504-wlc-fortigate-utm-l3-device

Dear All
I have a 2504 Wireless Controller with multiple radios attached. I currently have a "private" WLAN configured (taking ip from windows server based DHCP of Range 192.1681.0/24 ) and working, but I need to add a Guest/Public WLAN which should take the IP from Other DHCP Configured on Fortigate UTM of range 172.16.0.0/24.
We have one SG300 switch in the office and the rest are basic switches.
Our firewall/router is a Fortigate UTM 240D
Find the attached network diagram for the issue.
Is there a SIMPLE way to enabling guest access that doesn't require VLANS (or are VLANS easier than I'm making them)?
Thanks.
- See more at: https://supportforums.cisco.com/discussion/12473186/how-do-i-configure-guest-wifi-access-using-2504-wlc-fortigate-utm-l3-device#sthash.aj1XcWI0.dpuf

Complete these steps in order to configure the devices for this network setup:
http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-vlan/70937-guest-internal-wlan.html
Configure Dynamic Interfaces on the WLC for the Guest and Internal Users
Create WLANs for the Guest and Internal Users
Configure the Layer 2 Switch Port that Connects to the WLC as Trunk Port

Internet access to the guest system for Host-Only configuration

Hello,
I have a windows host linux guest vBox environment and it's configured as host-only. How can I enable internet access within the guest? I am towards the end of a RAC installation and upon running buildcluster.sh, it says the recommended RPM "oracle-validated" not installed or has unsatisfied dependencies. It seems i have quite a few RPMs need to download and thus prefer to be able to connect to the internet within the guest so i can do it from the Oracle yum server.
Thanks,
Harry

Hi,
this won't work so easiliy with a "Host Only" network.
You either need a bridges network or a NAT network.
Easiest thing probably will be to add another interface (network) to the VM and assigned it as bridged.
Then download/update oracle-validated and remove the interface again.
This way, you don't need to change anything on the server.
Regards
Sebastian

"No internet access" on Guest Wifi

Similar Messages

Maybe you are looking for