Users are unable to access internet when they are connected to Guest Wifi

[sharath.babu9022@gmail.com]

Users are unable to access internet when they are connected to Guest Wifi. We are using 2504 model WLC and it is running on 7.6.130.0 version. We are using web authentication (Layer 3) for Guest Wifi, when user is connected to the Guest wifi they are getting an IP address through DHCP, while they are redirected to the virtual IP address of the WLC, they are getting request timed out.

Users are not prompted to enter username and password. We manually entered http://1.1.1.1/login.html in the browser but no luck. Any help is appreciated. I have attached the debug logs from the WLC and 10.237.4.0/24 is the guest wifi subnet.

[Sathiyanarayanan Ravindran]

Hi Sharath,

Try to create a ACL on the WLC with any any allowed and map it to the WLAN Pre-authentication ACL and see whether it gets redirect to the internal portal page.

On Security-->Access Control List-->Access Control List

[sharath.babu9022@gmail.com]

Hi Sathyanarayanan,

Thanks a lot for your response!

I did add an access list on the WLC but instead of any any I added an access list allowing traffic from any to 1.1.1.1 and reverse access from 1.1.1.1 to any and the issue got resolved. As expected, user got redirected to the web page and prompted for the username and password. After Authentication, users were able to browse internet. 

Thanks again for your guidance!

[sharath.babu9022@gmail.com]

Hi Sathiyanarayanan,

We added an access list to permit traffic between 1.1.1.1 and any host. After that, Guest users were redirected to https://1.1.1.1/login.html web page for authentication as expected. 

The issue is resolved. 

Thanks for your help!

[Sathiyanarayanan Ravindran]

Great :)

[AllanGrah]

I'm late to the party but was going to suggest the ACL as well as that issue hit us during some testing.

On a side note, that 7.6 code.   Eek.    I thought that 7.6 train was deprecated for all its' issues?    (it gave us numerous issues)

[Sathiyanarayanan Ravindran]

Hi Allan,

Yes, Its no more recommended by Cisco. If you're running in 7.6 code, Upgrade the WLC to Cisco recommended one.

Below link is for your reference to choose the Image based on controller model.

Cisco WLC OS Suggestion 

Also one more point I want to add here, Using 1.1.1.1 as Virtual IP is also not recommended by Cisco. refer this tech-notes WLC Virtual IP address 1.1.1.1