SSID Connected, not internet

[lAhmed Saadl]

Dears,

Appreciate your support, as I am facing a weird case. I had a configured SSID for guest users on all of APs that was working normally. Suddenly yesterday, when clients tried to join to it, they got an IP address. but still can't reach the internet.

I can trace the IP which user got. It passes through the firewall to the GW with no issue. no change had happened to VLAN or Interface assigened to this SSID.

 Security Policies: [WPA2][Auth(PSK)]

the starange thing here, is while I try to uncheck status or even uncheck Brodcast SSID, it still appears, and clients see it and join it ,too.

[Mark Elsen]

  - Are you using a controller ? And or what is the model and software version ?

 M.

[lAhmed Saadl]

Hello Marce, 

Yes. WLC 5520 series. Software of 8.10.171.0

[Mark Elsen]

                           >...Yes. WLC 5520 series. Software of 8.10.171.0
   Have a checkup of the controller configuration, for that you need the output of the show run-config command (with no prompts in between) , and have it parsed by : https://cway.cisco.com/wireless-config-analyzer

 M.

[lAhmed Saadl]

Hello again Mace,

I did the checkup, found some errors that maybe irrelevant. Could you please advise about what should I need to pay attention to in the result?

[Mark Elsen]

              >....Could you please advise about what should I need to pay attention to in the result?
                                       - Attach the result  to your next reply , 

M.

[lAhmed Saadl]

Hello Marc,

Please find the attached file. Also I have notice something strange when I uninstall NIC and install it again it gets ip 10.50.X.X and everything works well, but after some time it gets ip of 10.200.x.x which has no internet capability. Please note there is no ISE configured 

[Arshad Safrulla]

Looks like you have a rogue DHCP server in your network. I would first make sure that the rogue DHCP server is eliminated. If your switch supports check the possibility of using DHCP/ARP snooping.

[lAhmed Saadl]

It's a bit little confusing as when I try to disable its status, and prevent broadcast, it still works and exists!!

[Mark Elsen]

  >It's a bit little confusing as when I try to disable its status, and prevent broadcast, it still works and exists!!
           - You may need to press an apply button or likewise in the GUI before the setting becomes effective,

 M.

[lAhmed Saadl]

Yes. I did that, but it didn't work. still broadcasting. Also tried via CLI config wlan disable <WLAN ID> 7. it shows it is disabled, but still broadcasting and users connect and assign IPs from it.

[Mark Elsen]

  >... Also tried via CLI config wlan disable <WLAN ID> 7. it shows it is disabled, but still broadcasting and users connect and assign IPs from it.
       - These observations are not normal and or not experienced by other users when using a wireless controller : I would suggest to backup the configuration and configure it from scratch again according to your purposes , 

 M.

[Ambuj M]

Can you resolve dns ? 

[lAhmed Saadl]

Dears,

Appreciate your remarkable support, and suggestions. Issue solved by reconfiguring it again. Also I'd like to mention that DNS point is a good point, too.

[Rich R]

- Consider a rogue AP broadcasting the same SSID?
- Consider an AP that might have ME - Mobility Express (Wave 2 APs) - or EWC - Embedded Wireless Controller (Catalyst 91xx APs) which might be acting as WLC on local subnet

- Update your WLC to latest code (currently 8.10.183.0) to eliminate possible bugs which may have been resolved since 8.10.171.0