Wireless Access

Hi all,

We are currently having issues with some of our remote site side controllers and 'Guest' captive portal access.
We have a master controller and 2 local controllers at our corporate location. All the 'Guest' users at the corporate
campus get to the captive portal page and authenticate just fine. The users at the remote sites with local controllers are having
issues getting the captive portal page. They can connect to the 'Guest' and they get an ip address. When they attempt to pull up a
web browser to accept the terms and agreement the page does not come up. We had the clients then try to type the URL manually in the browser that didn't work for them either. We had the clients then ping the ip on the controller for the Guest VLAN the pings were successful.  We then had them try to ping the 'Guest' gateway the pings were unsuccessful. The gateways are located back at corporate. If you get on the local controller itself you can ping both just fine. It seems to be an issue with the GRE tunnel or something with the client.  I am currently working on the issue with TAC, but wanted to see if anyone has seen an issue like this before or have any other suggestions. All of our controllers are currently on 6.3.1.3. This all seemed to be all fine before we went to 6.3.1.3...not sure if it is a bug in the code.

Any help or suggestions would be appreciated.

Thanks,

Bill

Bill,

Continue to work with TAC.  While we sit here and play the guessing game with limited information, TAC has or can ask for all your information and hopefully drive this to resolution.

The first question I would ask is if your guest users can resolve DNS, because that is required for Captive Portal.

We need to first make sure gateway is always reachable else there could be chances of GRE tunnel flapping.

If the GRE tunnel is always stable and not flapping; just want to know what happens if we just bounce the interface.

You could ask help TAC to replicate in-house and see if we are able to recreate the problem.

Are there some commands in the cli I could run to validate the GRE tunnel?

Yes, as colin mentioned that should be show datapath tunnel table will provide tunnel status info

---

@bingdude wrote:

Are there some commands in the cli I could run to validate the GRE tunnel?

---

Show datapath tunnel table | include <ip address of the far side>

Make sure the encaps and decaps are increasing.

Been working with TAC.  Looks like we have an issue with GRE tunnels from our remote local controllers pointing to the VRRP address.  Once we switched over to use the physical IP of the remote local controllers the GRE tunnels have stabilized.

Make sure VRRP is stable and not flapping as that would cause the issue.

Remove any band-width contract applied on that VLAN if any,

show vrrp <vrrp id> statisticcs will provide stats