Controllerless Networks

This is the 2nd time this has occurred where I have went through setting up a guest SSID and I selected the "guest" option under the 1st step "WLAN Settings" then selected Virtual Controller managed for client IP assignment and default for client VLAN assignment.  Security is "none" and access is "unrestricted".  The client connects and gets a 172.31.x.x like they are supposed but are unable to access the internet.  Any ideas?  

The IAP has 2 other SSIDs that are assigned to different VLANs and they work fine.  The AP IP address is on a management VLAN and this subnet has access to the internet (assuming the 172.31.x.x NAT's the IP address of the AP)

Does this client get an ip address?  Yes?  Can the client do an nslookup?  If not, check to make sure that the ip address of the IAP can reach the internet, since that is the traffic that is natted out...

yeah it's getting an IP and is able to nslookup but it's using the internal DNS.  We just found out the firewall was blocking traffic so now users on the guest network can get out to the internet.  Question though, how do we change the DNS server for guest access to Google's DNS so it isn't querying the internal DNS (potential security issue).

I think I found out how to change the internal DHCP for guest networks - 

http://www.ebrahma.com/2013/09/aruba-networks-what-is-iap-magic-vlan/

You can do this by creating a local DHCP scope and assigning the required DNS servers there.