No connectivity to access points with Cisco C899

[matteomonticciolo1372920]

Hi, I have a Cisco C899 and various APs of different brands, when I connect them to the network, they get the IP correctly but they don't communicate with the outside, the devices that connect to the wifi go into error.
The router is connected to the network via the Gigabitethernet 4 interface and with VLAN 1 with IP 192.168.2.1
what can it be?
*other devices connected via cable work correctly
here is the configuration

Current configuration : 2760 bytes
!
! Last configuration change at 16:06:00 UTC Sat May 25 2024
! NVRAM config last updated at 13:32:00 UTC Sat May 25 2024
!
version 15.5
service config
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname router
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
ethernet lmi ce
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!


!
ip dhcp excluded-address 192.168.2.1 192.168.2.20
!
ip dhcp pool DHCP
network 192.168.2.0 255.255.255.0
dns-server 8.8.8.8 8.8.4.4
default-router 192.168.2.1
!
!
!
ip cef
no ipv6 cef
!
!
!
!
!
multilink bundle-name authenticated
!
!
chat-script lte "" "AT!CALL" TIMEOUT 20 "OK"
!
!
!
!
!
license udi pid C899G-LTE-GA-K9 sn FCZ211794BW
!
!
vtp mode transparent
!
!
!
!
!
controller Cellular 0
lte modem link-recovery rssi onset-threshold -110
lte modem link-recovery monitor-timer 20
lte modem link-recovery wait-timer 10
lte modem link-recovery debounce-count 6
!
vlan 2
name EPOS
!
vlan 3
name Management
!
vlan 10
name LAN
!
!
!
!
!
!
!
!
!
!
!
!
interface Cellular0
no ip address
encapsulation slip
dialer in-band
dialer string lte
!
interface Cellular1
no ip address
encapsulation slip
!
interface FastEthernet0
no ip address
shutdown
duplex auto
speed auto
!
interface GigabitEthernet0
no ip address
!
interface GigabitEthernet1
no ip address
!
interface GigabitEthernet2
no ip address
!
interface GigabitEthernet3
no ip address
!
interface GigabitEthernet4
no ip address
!
interface GigabitEthernet5
no ip address
!
interface GigabitEthernet6
no ip address
!
interface GigabitEthernet7
no ip address
!
interface GigabitEthernet8
ip address dhcp
ip nat outside
ip virtual-reassembly in
duplex auto
speed auto
!
interface GigabitEthernet9
no ip address
shutdown
duplex auto
speed auto
!
interface Vlan1
ip address 192.168.2.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
!
interface Vlan10
no ip address
!
ip forward-protocol nd
ip http server
no ip http secure-server
!
!
ip nat pool no-overload 192.168.1.97 192.168.1.97 prefix-length 24
ip nat inside source list 7 pool no-overload
ip route 192.168.1.0 255.255.255.0 GigabitEthernet8
!
!
access-list 7 permit 192.168.2.0 0.0.0.255
!
control-plane
!
!
!
mgcp behavior rsip-range tgcp-only
mgcp behavior comedia-role none
mgcp behavior comedia-check-media-src disable
mgcp behavior comedia-sdp-force disable
!
mgcp profile default
!
!
!
!
!
!
!
line con 0
no modem enable
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
stopbits 1
line 3
script dialer lte
no exec
line 8
no exec
line vty 0 4
login
transport input none
!
scheduler allocate 20000 1000
ntp server pool.ntp.org
!
end

[marce1000]

          >... the devices that connect to the wifi go into error.
   - What kind of error(s) are you talking about ; provide a screenshot (e.g.)

 M.

[matteomonticciolo1372920]

"No internet connection" here is the error that the phone returns, and also the other devices that try to connect to the wifi network

[marce1000]

    - Check if devices can get an address from a (the) DHCP server to start with , preferably use a portable on that wireless network for in depth testing 

 M.

[matteomonticciolo1372920]

Hi everyone, I have a Cisco C899 that works perfectly when connected via cable, I recently connected an AIR-3802i AP, when I connect my phone I get the IP but I can't go to the internet, I connected the AP to a another router with the same addresses and connected so it works correctly, I don't understand where the problem could be, the port the AP is connected to the Cisco router is in the same VLAN where I connected my PC via ethernet, but my PC works , the ap no, what could it be?

[marce1000]

 - Depends start by checking if the phone can get an IP address when the AP is connected to the C899  (e.g.)

 M.

[matteomonticciolo1372920]

hi, the phone correctly obtains the IP from the AP, I also tried other APs connected to the C899 network and they have the same effect, the clients obtain the IP but are unable to go to the internet

[marce1000]

 - You need to debug where the Internet access 'stops' ; with tools such as tracert to 8.8.8.8 (e.g.)  ; there are networking apps on phones which can do that to , 

 M.

[Rich R]

1. How is the 3802 configured?  Do you have a WLC (what model and what software) or are you running Mobility Express on the 3802 (what software version)?
2. How is the WLAN on the 3802 configured?  Is it configured for flexconnect local switching or central switching (only applicable if connected to WLC)?  Does the AP switchport have the correct VLAN configuration?

A few general comments about your config:

> ip nat pool no-overload 192.168.1.97 192.168.1.97 prefix-length 24
> ip nat inside source list 7 pool no-overload
> access-list 7 permit 192.168.2.0 0.0.0.255
You've configured the NAT without overload (and called the pool no-overload) with only a single IP address.  That means only 1 device can get a NAT translation.  If any other device gets that translation before your test device then the test device will not be able to get any NAT.  Are you sure that's what you want?
Also you're using DHCP for the Gig8 interface IP address but using a static allocation for your NAT pool (192.168.1.97) which could conflict with a DHCP assigned IP on the LAN?

> ip route 192.168.1.0 255.255.255.0 GigabitEthernet8
Static route to interface name is considered bad practice on a broadcast network (LAN).  You should only use those on point to point networks like a tunnel or dialer.  You should always specify the next hop IP address on a LAN based static route.  You can also add in the interface name to ensure that no recursive route lookup to another interface can happen - that's considered good practice.  For example:
ip route 192.168.1.0 255.255.255.0 GigabitEthernet8 192.168.1.1
If you don't know the next hop IP because you're using DHCP then you can also tell IOS to use the DHCP provided gateway address:
ip route 192.168.1.0 255.255.255.0 GigabitEthernet8 DHCP