Mobile phones dont get internet access through WLC-5508

[pramodlbs92]

Hey all-

I have a WLC 5508 on my network.  Recently mobile phones can connect to the wireless network and obtain a valid IP address.  This IP is pingable from a workstation anywhere else on the network and we are able to ping internal interface of router from mobile phone but we are not able to ping outside interface of router. However, these phones will not display web pages.  They come up page cannot be displayed.  I even tried putting Google's IP address in the phone's browser and it still did not display.  I can connect through the same WLAN via a laptop or iPad.  These devices have no problem displaying web pages. Laptops connect and display web pages and smart phones connect, gain IP but do not display web pages.  Comes up page cannot be displayed.  This matters not whether its an iPhone or Android platform.

Any ideas on where to go from here?  I appreciate your help and feedback in advance.

Thanks,

Pramod

[Flavio Miranda]

Hello,

 Which authentication method do you use on this WLAN ?

Do you have proxy on your network? 

If you change the authentication method to PSK (Considering it is not yet), which result you get? 

When you use the laptop or iPad do you ping the router's outside interface just fine? 

 When connecting on this WLAN, both laptop and Phone gets IP address on the same range? 

[pramodlbs92]

Hi Favio,

I am using PSK authentication method only. When I am connecting Laptop I am able to ping outside interface of router and everything is working fine but when  I am trying to ping outside interface of router with phone it is failed. Phones are pingable from laptop connected to WLAN and WLC. Laptops and phones are getting ip address on the same range with correct dns.

Problem is with android phones only.

I have not implemented any mac filtering policy. there is only one VLAN and only one WLAN configured on WLC, NAT and dhcp server is configured on router.

[Flavio Miranda]

And no proxy on the network? Proxy could explain if the Android have not configured. 

 Another possibility could be something related to the Android device and not the network. 

[marce1000]

      @Flavio Miranda    >...something related to the Android device and not the network. 
      - Indeed  that's the reason why poster my want to engage in client debugging : https://www.cisco.com/c/en/us/support/docs/wireless/aironet-1200-series/100260-wlc-debug-client.html   , client debugs can be processed and analyzed with https://cway.cisco.com/wireless-debug-analyzer and don't forget to consider using https://software.cisco.com/download/specialrelease/8f166c6d88b9f77aabb63f78affa9749

 M.

[marce1000]

 - Since now the 5508 is getting rather old it is  becoming always advisable to use the last release that it can still run  : https://software.cisco.com/download/specialrelease/8f166c6d88b9f77aabb63f78affa9749 , for the rest use client debugging as explained in https://www.cisco.com/c/en/us/support/docs/wireless/aironet-1200-series/100260-wlc-debug-client.html , you can have client debugs processed and analyzed with : https://cway.cisco.com/wireless-debug-analyzer

 M.

[przemyslaw.wieczorek]

Do you authenticate only via PSK only or you also with ISE or maybe you are doing MAC filtering somewhere? You need to keep in mind that phones use Private MAC so different MAC per WLAN.
When you connects to WLAN with phone do you get all details from DHCP (with DNS)? Try to enter DNS manually on your phone to 8.8.8.8 or 1.1.1.1 and check again.

[pramodlbs92]

We are using PSK authentication method only. No MAC filtering policy is enabled. all the android clients are getting correct ip address and dns.

[Leo Laohoo]

What is the model of the APs and what is the firmware of the WLC?

[pramodlbs92]

Hi Leo,

We are using two models of AP: 1- AIR-LAP1262-A-K9, AIR-CAP1602I-N-K9 and WLC-5508-K9 with software version-8.0.121.0

[Rich R]

The 1260 APs have been end of support since 2018:
https://www.cisco.com/c/en/us/obsolete/wireless/cisco-aironet-1260-series.html
AireOS 8.0 has also been end of support since 2018:
https://www.cisco.com/c/en/us/products/collateral/wireless/8540-wireless-controller/eos-eol-notice-c51-739984.html

So you are running VERY old software - it's not even the latest release of 8.0!

Given this diabolical state of affairs (not really surprising you're having problems) your options are limited.  You should upgrade to at least 8.3.150.0 but be aware that you will encounter problems due to the field notices below so you will need to implement workarounds for that - both config and time settings - follow the field notice instructions carefully, step by step.

Failing that you can try rebooting your controller and all APs - it might help.

Also get simultaneous packet captures of the traffic from the AP switch port, and also the controller in from the AP and out to the router (or at the router).  Then you'll see where the packets are getting dropped or blocked and that might help you understand what the problem is.

You should also seriously consider upgrading to supported, modern equipment.