Controllerless Networks

The "Guest" network on our Aruba Instant 105 network stopped working.  Here are some of the things that I've tried to resolve the issue:

1. Upgraded firmware to latest release.  I even went to the early release version after the standard version didn't fix it.  We're currently on 6.4.3.1-4.2.0.0_51112.

2. Completely deleted the Guest network and added it back in.

3. We use the internal authenticated splash page, but I've tried setting it up with "None" to eliminate that as the issue.

4. I've tried many variations on the settings, but in the past we've just used the default.

5. DHCP for the Guest network is virtuatl controller managed.  I've tried to manually specify a DHCP address and mask so that it doesn't use the default.  It doesn't make a difference.

A Windows 7 laptop connects to the Guest network without issue, but then the yellow triangle and exclamation point appear on the wireless connection of the laptop.  It has an IP address, but I can't ping anything.

Hopefully someone can help me with this.  Thanks in advance!

What part of this is not working?

Connected devices through the guest network don't have any Internet access.  The device grabs an IP address, but the splash page never appears and they can't get out to the Internet.

Can those devices resolve DNS?  Was anything changed recently?

No.  They get an internal IP address as the DNS server, but they can't ping anything.  That includes pinging the default gateway directly.  It really seems like the access points are blocking the traffic, but I have the security set to allow everything to make sure that's not the issue.

Nothing had been changed when it stopped working.  I have since updated the firmware, but that was only after it was already "broken".

What is the default gateway on that network for those clients?  That devices is responsible for forwarding the traffic to where it needs to go.  Can your clients ping that?

The gateway shown on the client is 172.31.98.1.  I'm assuming that's the default address for the AP-105, right?  I don't see a place where you set that information on the AP.  No, you can't ping that address from the client.

Something must have changed for it to not be working.  I don't know enough about your environment to say what..

What other information can I give you that might help?

I just tried creating another network on the access point.  I left it as Employee instead of Guest and made it wide open without any encryption.  I changed it to use the virtual controller for the IP assignment.  When I connect to this new network I get the same IP address, but still can't get to the Internet.  The only thing different is that I CAN ping the default gateway when it's setup this way.

Note that when using the virtually assigned scope in Instant all the traffic that goes out is source NAT:ed behind your APs IP-address. In this case I would guess that your logon role for the guest network doesn´t allow ping but your new open network does.

Next step for your guests is to resolve DNS, this means that the request must be NAT:ed out the APs IP-address, routed perhaps in a router or firewall (where it also must be permitted) and successfully reach back to the AP for the client to get it.

Verify what DNS server you´re assigning to your clients from the Instant cluster. Verify what the logon role for your guests permit (you might want to add ping here for troubleshooting). After that verify that you can ping your DNS server. If so, verify that you can resolve a DNS name.

If you don´t find the error following those steps, please provide us with a simple drawing of your environment with APs, Switches, Routers, Firewalls included.

Cheers,

Chris

I don't understand why/how the Guest network doesn't allow ping.  I'm setting it up and choosing "Allow Any to All Destinations".  Shouldn't I be able to ping then?

same exact issue. Discussing over in this thread: http://community.arubanetworks.com/t5/Aruba-Instant-Cloud-Wi-Fi/Instant-splash-page/m-p/249403

Ping not being allowed and a certificate error are the same thing?  Is there something else that makes it similar?

I should have posted this sooner.  We discovered that there was a bad DNS entry assigned on the access points.  I hadn't realized that you could go in and manually set that information, but once I did it was just a matter of setting the DNS address on each access point to the correct address.