Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 5 replies
  • Subscribers 5 subscribers
  • Views 11018 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

No WiFi-connectivity with 3rd party AP, only in router mode

#ID

I tried to expand my network. At the moment it is all wired. I have a ASUS RT-AC87U consumer grade router. It's possible to set it into access point mode. I did so. Furthermore, I gave it a static IP in the range I wanted to use for the WLAN-VLAN. My configuration is as follows:

ASUS RT-AC87U in AP mode, IP static x.x.6.100

The AP is plugged into a VLAN capable switch, into a port which is mapped to VLAN 6.

The UTM has a WLAN_VLAN Interface with the same VLAN ID (6). A DHCP Sever (in UTM) is running for this interface with an IP range x.x.6.0 - x.x.6.99. The AP itself has two static entries: x.x.6.100 for the 2.4GHz band and x.x.6.101 for the 5GHz band (it has two distinct MAC adresses).

With this configuration clients won't be able to access the Internet and very often not even the WiFi. They do also not show up in the IPv4 lease table in UTM. The APs management interface isn't reachable under its IP. UTM says "no route to host". To access the GUI I have to set a static IP on my Computer in the x.x.6.x range.

The same is true for the situation, when the ASUS RT-AC87U is in router mode (same configuration as above). But now the router handels DHCP itself, all the clients get connected and have internet connectivity - when I disable SSL scanning. But with this configuration I am not able to let the devices communicate with each other, if they are in different VLANs. (Say a hardwired printer in the printer VLAN and a laptop connected to the WiFi.)

Any idea what went wrong? I basically follows this FAQ: How-To us a wireless router with the UTM.



This thread was automatically locked due to age.
Parents
  • 0

    Do you use 802.1q VLAN protocol? Because that's what Sophos is using.

    Did you configure the default gateway on the x.x.6.100 and x.x.6.101 to point to the UTM on the (also statically configured) x.x.6.y interface?

    And did you also configure masquerading rule for this subnet?

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels

    Indeed, I am using the 802.1q VLAN protocol and NAT rules are set (e.g. VLAN_WLAN -> Internal, or VLAN_WLAN -> external).

    Could you go into more detail about the gateway? I cannot configure every client, e.gg some devices like a google chromecast have no management interface to do so, they just rely on getting an IP from the DHCP-Server. They were connected to the WiFi beforehand and WiFi credentials haven't changed (same SSID and same WPA2 Key).

Reply
  • 0 in reply to apijnappels

    Indeed, I am using the 802.1q VLAN protocol and NAT rules are set (e.g. VLAN_WLAN -> Internal, or VLAN_WLAN -> external).

    Could you go into more detail about the gateway? I cannot configure every client, e.gg some devices like a google chromecast have no management interface to do so, they just rely on getting an IP from the DHCP-Server. They were connected to the WiFi beforehand and WiFi credentials haven't changed (same SSID and same WPA2 Key).

Children
  • 0 in reply to #ID

    The 2 interfaces of the access point (2.4 and 5 GHz) have their own IP-addresses set. I suppose they are set as static addresses. In that case you should also configure the default gateway (which should be the UTM (on this VLAN interface). Also the UTM should have a statically configured IP-address in the x.x.6.x range (but if you have a DHCP server configured on the UTM, that should be okay).

    Can you show picture of how the VLAN interface on the UTM is configured and also a picture of the DHCP server for this interface?

    When using DHCP there's no need to manually configure each wireless client (so should be no problem for chromecast and other devices).

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels

    The two WiFi Bands have their own static IP set in UTM:

    Concerning the default gateway: Isn't the UTM always the x.x.x.0 of each interface I create? My UTMs IP is 10.2.3.4, but the VLAN_WLAN interface is set to 10.2.6.60:

    Then the DHCP server is using that interface and has a certain range of IPs (note that the static IPs are out of the range!). The default gateway is set to the interfaces' IP address, as well as the DNS server 1.

    I'm happy to improve all those settings if anything isn't properly configured!

    Thank you in advance!

  • 0 in reply to #ID

    In a /24 network the address x.x.x.0 is always the network address (this address cannot be associated with any client) and x.x.x.255 is always the broadcast address which also cannot be assigned to any client. But in your DHCP settings everything seems fine related to the gateway (10.2.6.60 which is also the VLAN interface address of the UTM). 

    I do see one thing tough.... Your UTM interface has 10.2.6.60 and 10.2.6.60 is also your first address in the DHCP scope. This could theoretically lead to 10.2.6.60 being handed out to another client, so it's better to change the start address to 10.2.6.61. Other than that, everything looks fine, so maybe time to further dig in your switch and to what kind of ports all your equipment is connected.

    Can you check if any device connecting to wifi gets an IP-address in the 10.2.6.x range? If none get an address, than I suspect something on your switch is not configured as it should.

    The switch connected to your UTM eth0 should use a tagged VLAN6 port to connect to the UTM, since UTM also uses tagged packets. Then most likely the access points need to be connected to an untagged port which is also in VLAN6 on the switch. (I say most likely since by default access points are not configured as tagged (VLAN) devices. If in your case they are, then the switch ports where the access point is connected should also be a tagged VLAN6).

    Does this give you enough information to further check what might be wrong?

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

Unfiltered HTML