AIR-AP3802I-B-K9 on Catalyst 9800-L can ping but not browse internet

[rmanning]

Have several sites where we installed AIR-AP3802I-B-K9 (Primary and IOS versions are 17.3.6.76) connecting back to Cisco Catalyst 9800-L (17.3.6) via AT&T MPLS (Ap is attached to Cisco switch which is connect to ATT Anira device which routes back to hub site where 9800-L is housed). When connecting to AP can ping any site (local or internet) but cannot browse to any local or internet websites on any browser. If we reboot the AP/Controller or Anira device we get about 10 minutes of browsing and then nothing again. Happening at 3 sites each of which have this model. We have other sites that work with no problem but are on AIR-CAP3702I-B-K9 (Primary software version 17.3.6.76; IOS 15.3(3)JPJ9$). Local ISP checks out good, AT&T Anira checks out good, have factory reset the APs in question, Tried using Static and DHCP.

[marce1000]

  - What does that mean , 'no more browsing' , meaning what error is seen  in the browser ? Can you also verify that when this happens , that 1) The AP is still connected to the controller   2) The client is still visible on the controller client list (too).

  M;

[rmanning]

Thanks. We Will get “sorry this site google.com took too long to load” happens on iPhones ipads laptops etc but the devices are still connected to the AP and the controller still sees the devices connected and ap online. I can Ping google via name or 8.8.8.8 with no drops.

[Scott Fella]

So is this FlexConnect and have you tested onsite to see if a wired device connected tot he same plan/subnet works?  Really seems like a NAT issue.

[rmanning]

Flex connect. And plugged straight in getting 60mbps down and up

[Scott Fella]

Take a look at your trunk port configurations your ap's are connected to.  Also make sure that the plans are being spanned across all the switches.  One test you can do is connect a laptop to a switch port that the ap is connected to on the same vlan that wireless clients would be placed on.  If you have issues, I would look at a wired network issue.  If not, then debug the client and see what is happening.

[Rich R]

Do you have all the 17.3.6 AP Service Packs applied as per TAC recommendation below?

Start testing/planning to upgrade to 17.9.3 when that comes out in the next few weeks.