No Internet Access but connected to domain. New install of Windows 7

[KYLE NGUYEN]

Hi everyone

I have a problem that's driving me nuts trying to troubleshoot. Brand new install of Windows 7 Dell latitude. I'm connected to our domain, but cannot browse the Internet with exclamation icon and msg "No Internet Access."

I can ping all internal servers and gateway. No issues there.

I took the laptop home and connected to my home network fine. Internet connection works perfectly.

But when I get back to the office, I tried connecting with both wired and wireless, both gives msg "No Internet Access."

Firewall is ASA 5505. I did some googling, and found some info on IP Shunning, but when I check my firewall settings, shunning is not enabled. 

Any help is greatly appreciated. Thanks. 

[KYLE NGUYEN]

That Cisco 3850 bug pretty much describes my symptoms.  

I don't have time to upgrade the IOS now, but I did reboot the problematic switch stack and all computers are working good. All new computers have internet access.

I will definitely upgrade to 3.6.5E later. 

Thanks for all your help! You saved my butt. 

[KYLE NGUYEN]

Yes, the provided config is for a switch stack of 3 members. Oddly enough, only 1 switch of the 3 members is not working. 

Then I have another stack of 2 switches in a different building that also having the same problem.

All other switches through out the campus is working perfectly. 

[ahmedshoaib]

Hi;

Can you verify below items:

1- Whether your company internet is running via proxy or not? If yes you need to configure proxy setting on your browser

2- Can you verify the your the IP address you getting in office is allowed for internet or NATTING on ASA Firewall.

3- During IP Address lease your are getting proper DNS server address.

Thanks & Best regards;

[KYLE NGUYEN]

1. No internet proxy.

2. Yes, the ip address is allowed. If I plug the laptop directly into the ASA Firewall, I get an internet connection immediately. If i go through the cisco switch, no internet access.

3. IP address leases are getting proper DNS server addresses.

I tried setting another new desktop, and it's having the same issue. No internet access, but I can join domain and ping all internal servers. It seems to block internet access on all new connections.

All computers that were working fine before still works like normal, no issues. 

Network topology

LAN >>> Barracuda Web Filter >>> ASA Firewall >>> Internet

[ahmedshoaib]

Hi;

Can you explain more on your network connectivity?

1. Your PC will get what IP Address, Mask & Gateway.

2. Gateway of PC is configured on Switch or Firewall.

3. If switch then Firewall has route to reachable to PC subnet.

Thanks & Best regards;

[KYLE NGUYEN]

1. PC gets IP address from DHCP server. 192.168.0.x

subnet mask 255.255.254 

gateway 192.168.0.239

2. Gateway is configured on Switch

3. not sure what you mean here

after some testing, any new computers I try to add to the network does not get Internet access. Traffic cannot reach the ASA Firewall for some odd reason.

All other computers that was working before this issue started is still working fine. Internet access is working. It's only affecting all the new computers I add to the network.  

[ahmedshoaib]

Hi;

New Computer and Old computers are on the same subnet or different.

And your Firewall have the reachability of 192.168.0.X network via switch.

Thanks & Best regards;

[KYLE NGUYEN]

Yes, old and new computers are all on the same subnet. 

ASA Firewall reachable by 192.168.0.1 via switch.

I can reach firewall from all the old computers. traffic from new computers doesn't reach firewall.

Nothing was changed on the firewall. this problem just started out of nowhere when I tried to add new latitude laptop with Windows 7.  

[KYLE NGUYEN]

After some more troubleshooting, I was able to narrow it down to a switch issue. We have seven Cisco 3850 switches spread throughout the campus.

I took the new laptop to each switch and plugged it in. I was able to connect to the network and ping all internal servers on all of them.

On two of the switches, I cannot connect to the Internet with msg "No Internet Access" even though I can still join domain and ping internal servers. 

What's weird is that old computers that's still connected to these two "problem" switches are still working fine with full internet access. It's only when I try to connect a new device that I lose internet access. 

Does this make any sense?