This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Separated zone clients are unable to surf on internet

Hi All,

I have 3 APX 320 connected in Mesh on 5 Ghz. Only the first AP is connected to LAN, while the others are meshed. One Wi-Fi is bridged to AP lan, and users are able to surf. I have also created another wifi (guest) as separated zone. Clients receive the IP but they are not able to surf and sometimes surfing is very slow.

Wi-Fi zone to WAN firewall rule is ON and it is the first rule.

NAT has been created.

Reboot and AP hard reset has been performed

The rule does not use any web filtering (either proxy or SSL inspection).

Drop-packet capture shows only multicast traffic, nothing else.

Any help?

Thanks

This thread was automatically locked due to age.

Top Replies

PhilippRusch over 1 year ago in reply to lferrara +1

There is a reduction in MTU size, when using separate zones in that particular network segment you are creating with this. This is due to the underlying VX Tunnel technology used to encapsulate the traffic…

Parents

0 Wayne Folta over 1 year ago

To clarify, you set up separate SSIDs on your APs for guests, each associated with a VLAN and the VLAN associated with a Zone? The only difference from what I and many others might have is that you have two of the APs connected via a mesh backhaul. Are you using 5GHz for the backhaul and 2.4GHz for the clients, or are you running the AP in dual 5GHz mode?
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 1 year ago in reply to Wayne Folta

I have a bridged to AP lan wi-fi network and a separated zone. APX 320 are inside a mesh network (5ghz) while users' network are on 2.4 GHz only.
Cancel
Vote Up 0 Vote Down

Cancel
0 Wayne Folta over 1 year ago in reply to lferrara

How do you separate the zone? Forgive my ignorance, but I have three SSIDs: Trusted, IoT, and Guest. The Trusted is bridged onto my internal LAN, while the other two are on their own VLANs, which have their own Zones. Each VLAN has its own DHCP -- I do this on the router, not the AP -- and its own firewall rules to get to the internet. Is this what you're doing except that you're using Mesh for your AP backhaul?
Cancel
Vote Up 0 Vote Down

Cancel
0 PhilippRusch over 1 year ago in reply to lferrara

There is a reduction in MTU size, when using separate zones in that particular network segment you are creating with this. This is due to the underlying VX Tunnel technology used to encapsulate the traffic.

I had this problem myself and used a script to set MTU on the clients to 1320.

This solved the problems you described immediately.

Mit freundlichem Gruß, best regards from Germany,

Philipp Rusch

New Vision GmbH, Germany
Sophos Silver-Partner

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up +1 Vote Down

Cancel
0 lferrara over 1 year ago in reply to PhilippRusch

Thanks PhilippRusch. What about if I set the MTU size on XG on 1320? I do not have controls on clients at home.
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 1 year ago in reply to lferrara

Setting the MTU to 1320 on XG wlnet2 interface does not fix the issue.
Cancel
Vote Up 0 Vote Down

Cancel
0 lferrara over 1 year ago in reply to lferrara

Even this kb does not work in my case. https://support.sophos.com/support/s/article/KB-000038265?language=en_US
I will create a new thread.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 lferrara over 1 year ago in reply to lferrara

Even this kb does not work in my case. https://support.sophos.com/support/s/article/KB-000038265?language=en_US
I will create a new thread.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data