Hello
On the Backup SSID doesnt look its the problem but as you said"i got the same DNS for both"
You could be pinging DNS cause its on the cache.... but remenber that on the remote site you have to put a DNS server they can reach in excample a local DNS server on the remote site and if you don thave it then you will have to put an public DNS server...
The other thing you need to check as it already said, its the role you are assigning to those users on that backup SSID... you wont be able to see it ofcourse on the table because you are disconected from the controller... but look whats the initial role you giving them on that AAA profile.
Where do you check this?
Well go to configuration and then go to AAA profile tab, then after it look for the AAA profile of the Backup ssid... and then there you look whats the initial role
After that
Go to access control and look for the name of that role you saw on the initial role, and look what permissions you got for it on the ACL which you will find inside it.
Are you using WPA2 PSK on the backup SSID?
Cheers
Carlos