I would like to ask for a help with our guest network no able to access internet.
My network is connected like this:
WLC <> Switch <> ISR4321 <> ISP
Guest network subnet: 10.43.52.0/24
Gateway: 10.43.52.1
DHCP for Guest WLAN is running in WLC (internal DHCP server)
Wireless Clients can get the right subnet for guest and can ping the gateway (10.43.52.1) in ISR432 but cannot access the internet.
It seems that there is nothing wrong with the WLC configuration since it can reach the gateway.
Here is the ISR configuration:
!
class-map type inspect match-any Internet-cmap
match protocol icmp
match protocol tcp
match protocol udp
match protocol http
match protocol https
match protocol pop3
match protocol pop3s
match protocol smtp
match protocol h323
match protocol h323callsigalt
match protocol bootpc
match protocol bootps
class-map type inspect match-all ICMP-cmap
match access-group name ICMP
policy-map type inspect router-guest-pmap
class class-default
pass
policy-map type inspect guest-router-pmap
class type inspect ICMP-cmap
pass
class class-default
drop
policy-map type inspect guest-outside-pmap
class type inspect Internet-cmap
inspect
class type inspect ICMP-cmap
inspect
class class-default
pass
!
zone security outside
zone security inside
zone security guest
zone-pair security guest-to-outside source guest destination outside
service-policy type inspect guest-outside-pmap
zone-pair security guest-to-router source guest destination self
service-policy type inspect guest-router-pmap
zone-pair security outside-to-inside source outside destination inside
service-policy type inspect outside-inside-pmap
zone-pair security outside-to-router source outside destination self
service-policy type inspect Outside-Router-pmap
zone-pair security router-to-guest source self destination guest
service-policy type inspect router-guest-pmap
!
interface GigabitEthernet0/0/0
description Internet
bandwidth 50000
ip address 78.90.19.11 255.255.255.252
ip nat outside
zone-member security outside
media-type rj45
speed 100
no negotiation auto
crypto map outside-map
service-policy output 50M-Shaper
ip virtual-reassembly
!
interface GigabitEthernet0/0/1
no ip address
negotiation auto
!
interface GigabitEthernet0/0/1.9
description Guest Wireless VLAN
encapsulation dot1Q 9
ip address 10.43.52.1 255.255.255.0
ip nat inside
zone-member security guest
ip virtual-reassembly
!
ip nat inside source route-map NAT-Route-Map interface GigabitEthernet0/0/0 overload
ip route 0.0.0.0 0.0.0.0 78.90.19.11 251
!
!
ip access-list extended ICMP
permit icmp any any echo
permit icmp any any echo-reply
permit icmp any any traceroute
permit icmp any any
ip access-list extended NAT
permit ip 10.3.0.0 0.0.255.255 any
permit ip 10.103.0.0 0.0.255.255 any
permit ip 10.43.52.0 0.0.0.255 any
ip access-list extended NO-NAT
permit ip 10.3.0.0 0.0.255.255 10.0.0.0 0.255.255.255
permit ip 10.103.0.0 0.0.255.255 10.0.0.0 0.255.255.255
permit ip 10.3.0.0 0.0.255.255 172.16.32.0 0.0.0.255
permit ip 10.103.0.0 0.0.255.255 172.16.32.0 0.0.0.255
permit ip 10.3.0.0 0.0.255.255 any
permit ip 10.103.0.0 0.0.255.255 any
permit ip host 10.43.52.250 host 10.2.34.98
!
route-map NAT-Route-Map deny 10
match ip address NO-NAT
!
route-map NAT-Route-Map permit 20
match ip address NAT
Thanks!
