Wireless guest have no connectivity in the DMZ

Question

Hi,
I am deploying a new wireless setup with two 2504 controllers, one for the corporate ssid and one for guest segment.
The anchor controller used for web-authentication has 1 leg in the inside network (10.x.x.x) and 1 leg in the dmz 192.168.100.x (to ASA 5515 v9.0) on the 192.168.100.0 /24 range.
The ASA has internal and external context.
The Mobility tunnel is up.
The ASA is doing DHCP, and the hosts receive IP addresses and (public) DNS 173.194.67.94.
Problem is the hosts cannot do DNS lookup and thus no redirection to the web-portal.
The ASA shows no denies. When I ping the DNS from the Anchor controller, I see the following.
Jul 11 2013 07:44:17: %ASA-6-302020: Built outbound ICMP connection for faddr 173.194.67.94/0 gaddr 10.101.114.172/815 laddr 10.101.114.172/815
Jul 11 2013 07:44:19: %ASA-6-302021: Teardown ICMP connection for faddr 173.194.67.94/0 gaddr 10.101.114.172/815 laddr 10.101.114.172/815
A packet sniffer shows that hosts connected send DNS requests and never get anything back.
How should approach this issue from here?

Answer 1

Hi,
after some changes, the WLC can now reach the public DNS server.
However, the hosts cannot do anything. (no nslookup, no ping)
I removed web-authentication from the WLAN config to simplify troubleshooting, but even so, the result is the same.
Host receives IP address and DNS server.
When I do a packet tracer on the outside context, from the guest (wifi) segment to the DNS, I see the packet is dropped.
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
my config is:
object network Guest_wireless
subnet 192.168.100.0 255.255.255.0
access-list GUEST extended permit ip object Guest_wireless any
access-list GUEST extended permit icmp object Guest_wireless any
access-group GUEST in interface Guest_wireless
interface GigabitEthernet0/3.2
nameif Guest_wireless
security-level 40
ip address 192.168.100.254 255.255.255.0 standby 192.168.100.253
object network Guest_wireless
nat (dmz,outside) dynamic "public ip"
Thanks