Hey folks,
I have a strange problem with a newly activated wireless subscription. First of all, I configured nearly 30 UTMs the same way, but this time it runs into a problem. As we "bricked" some APs due to nervous technicians onsite I usually configure the whole WLAN thing in our office, and after every AP has the needed firmware from the UTM he will be connected to (via DHCP 234 option) I test the WLAN config.
The actual customer only wants a guest wireless network, so I created a separate zone config. Firewall rules allow Any to Internet IPv4, web filtering is not active, Masquerading is active. DNS servers are from google.
The client (iPhone6) connects successfully to the wireless network:
hostapd: wlan1: STA 11:22:33:44:55:66 IEEE 802.11: authenticated
hostapd: wlan1: STA 11:22:33:44:55:66 IEEE 802.11: associated (aid 1)
awelogger[1294]: id="4103" severity="info" sys="System" sub="WiFi" name="STA authentication" ssid="EQ-GAST" ssid_id="WLAN1.0" bssid="00:1a:8c:b2:55:24" sta="11:22:33:44:55:66" status_code="0"
awelogger[1294]: id="4104" severity="info" sys="System" sub="WiFi" name="STA association" ssid="EQ-GAST" ssid_id="WLAN1.0" bssid="00:1a:8c:b2:55:24" sta="11:22:33:44:55:66" status_code="0"
hostapd: wlan1: STA 11:22:33:44:55:66 WPA: pairwise key handshake completed (RSN)
awelogger[1294]: id="4101" severity="info" sys="System" sub="WiFi" name="STA connected" ssid="EQ-GAST" ssid_id="WLAN1.0" bssid="00:1a:8c:b2:55:24" sta="11:22:33:44:55:66"
hostapd: wlan1: STA 11:22:33:44:55:66 IEEE 802.11: disassociated
awelogger[1294]: id="4102" severity="info" sys="System" sub="WiFi" name="STA disconnected" ssid="EQ-GAST" ssid_id="WLAN1.0" bssid="00:1a:8c:b2:55:24" sta="11:22:33:44:55:66"
hostapd: wlan1: STA 11:22:33:44:55:66 IEEE 802.11: deauthenticated due to inactivity (timer DEAUTH/REMOVE)
But on the iPhone it says "no internet connection". Looking under the info button I can see that it does not obtain an IP.
Looking in DHCPD log I can see that it requests an IP and that the server offers one:
dhcpd: DHCPDISCOVER from 11:22:33:44:55:66 (kb) via wlan1
dhcpd: DHCPOFFER on 192.168.71.101 to 11:22:33:44:55:66 (kb) via wlan1
dhcpd: DHCPDISCOVER from 11:22:33:44:55:66 (kb) via wlan1
dhcpd: DHCPOFFER on 192.168.71.101 to 11:22:33:44:55:66 (kb) via wlan1
There are no blocks in the firewall log, same on IPS.
We are connected via site-to-site IPSEC VPNs to our customers and firewall rules allow any from us to them and the other way. As I said above, I configured all wireless protections and APs this way in the past and tested them successfully and never had any problem with it. I could imagine everything will be fine when the AP is physically at customer's site, but what if not...
Has anyone an idea, what is going wrong here? The UTM has 9.505-4 installed.
This thread was automatically locked due to age.
