topic Re: Can't join domain over WiFi in Wireless

Can't join domain over WiFi

PhilAngell7132 — Wed, 05 Jun 2019 15:45:53 GMT

Hi All,

I have a network setup where there are 2 VLANs. The servers are on 118 and the clients are on 128. The server ports on the MS120 are set to trunk mode and all the other ports are access on 128. Clients connected directly into the switch work fine. I have a single MR20 that is broadcasting an SSID in bridge mode. I can connect to the WiFi network fine and I am even getting an IP address from the server on VLAN 118 (so DHCP is working). However if I try to ping the server address or the domain name I get:

REPLY FROM 10.128.128.128: destination net unreachable.

Any ideas as to how I make the wireless clients communicate with the network properly?

The router on this network is an MX84 which relays DHCP requests to the server on VLAN 118.

Re: Can't join domain over WiFi

SoCalRacer — Wed, 05 Jun 2019 17:32:49 GMT

Check the wireless firewall rules. Do you have any rules in there?

Re: Can't join domain over WiFi

Rasmus Hoffmann Birkelund — Wed, 05 Jun 2019 17:52:36 GMT

Are you using a local DHCP server or Meraki DHCP on the SSID?

Is the AP connected to a switchport in trunk mode, or access mode?

Is VLAN tagging enabled?

Re: Can't join domain over WiFi

Philip D'Ath — Wed, 05 Jun 2019 20:57:13 GMT

You are not using bridge mode, because you are getting a response from 10.128.128.128, which is only used in Meraki NAT mode.

Go back and re-check the settings and change the SSID to bridge mode.

Re: Can't join domain over WiFi

PhilAngell7132 — Thu, 06 Jun 2019 08:30:54 GMT

Hi Philip,

It is definitely in bridge mode (see below).

Re: Can't join domain over WiFi

PhilAngell7132 — Thu, 06 Jun 2019 08:33:19 GMT

Hi rbnielsen,

DHCP is running on a windows server, the WiFi clients get an IP address from this server fine. I have tried changing the port the AP is connected to in access of trunk mode. I have tried turning VLAN tagging on but I wasn't too sure which VLAN(s) to add to it - should it be the client VLAN, the server VLAN or both?

Many thanks,

Phil

Re: Can't join domain over WiFi

Philip D'Ath — Thu, 06 Jun 2019 08:49:32 GMT

Are you sure the clients are being dropped into the correct VLAN?

Have you got some MR firewall rules enabled, such as disable local LAN access?

https://documentation.meraki.com/MR/Firewall_and_Traffic_Shaping/'Deny_Local_LAN'_settings_in_Cisco_Meraki_MR_firewall

Re: Can't join domain over WiFi

Rasmus Hoffmann Birkelund — Thu, 06 Jun 2019 09:40:16 GMT

@PhilAngell7132 wrote:
Hi rbnielsen,
DHCP is running on a windows server, the WiFi clients get an IP address from this server fine. I have tried changing the port the AP is connected to in access of trunk mode. I have tried turning VLAN tagging on but I wasn't too sure which VLAN(s) to add to it - should it be the client VLAN, the server VLAN or both?
Many thanks,
Phil

If you're getting errors from 10.128.128.128, you are still using Meraki DHCP.

You sure it's in Bridge Mode? Did you check the correct SSID?

Re: Can't join domain over WiFi

PhilAngell7132 — Thu, 06 Jun 2019 15:21:46 GMT

SoCalRacer,

Thank you that was it, there was a random layer 3 wireless firewall rule blocking access to the local LAN. Must be a default policy because I hadn't set it.

Thanks again,

Phil

Re: Can't join domain over WiFi

heathicus — Tue, 01 Apr 2025 17:06:58 GMT

I had the same problem, thanks for telling me what to check. I overlooked the SSID-specific firewall rules. I allowed outbound traffic when it was set to deny for Any->Local LAN for that specific SSID and it fixed it. Can't say it's default, but for that particular SSID, we had that set so it prevented LAN access before.

Re: Can't join domain over WiFi

Rasmus Hoffmann Birkelund — Tue, 01 Apr 2025 17:59:47 GMT

The Local LAN rule is always set to Deny on the first SSID. On all other SSIDs it's Allow.