new BYOD range not getting internet

[maark]

I have setup a new range of internal addresses as allocated by kcom our internet provider for student byod use. am going to restrict the allowed sites using lightspeed.

have setup new vlan on all switches, vlan and security profile on meru, dhcp scope. put ip helper address in switch.

A phone or laptop can connect to the wireless network and gets an IP address and gets internal gateway on 10.3..... range which corresponds to the vlan. Also lightspeed has this range set in source exemptions so they don't need authentication

The wireless connection icon shows connected and internet access.

when i go to web i get err_connection_refused Google refused to connect

in edge/IE - temporary dns error - INET_E_RESOURCE_NOT_FOUND

I can ping internal DNS and gateways

If I ping bbc.co.uk it resolves the address to 151.101.0.81 even though it times out which is usual so it is resolving names

I am missing something but not sure what - light speed say to check VLAN gateway on the switches, SSID’s and DHCP scope but can't see anything wrong.

If I connect with a phone it shows router as http://lightspeed.ourdomainname rather than the 10.3 gateway it should show and that shows for other guest network that works ok so I think this is the problem.

Any idea what I have done wrong or how to troubleshoot as struggling - any help appreciated.

[FN-GM]

Have you checked ports TCP/80 & TCP/443 are open?

[maark]

Have you checked ports TCP/80 & TCP/443 are open?

 

whereabouts - on switch or lightspeed or do you mean from laptop?

Edited February 27, 2019 by maark

[maark]

running netstat on laptop i get listening on port 80 which suggests it is open can't connect to http or https sites

I think it is due to the fact that gateway is going to lightspeed rather than 10.3..... but can't see why as settings seem the same as guest wifi which works

[FN-GM]

You would check the ports on the network firewall.

 

Is this a new IP range or an existing?

[maark]

You would check the ports on the network firewall.

 

Is this a new IP range or an existing?

 

Its a new range setup for us by kcom.

The connection is firewalled by them.

Am beginning to think it may be at their end - they will only allow specific internal IP addresses to connect.

They have told me they have been setup but maybe they have not allowed them.

[Prevention]

Have you setup the New Subnet on Lightspeed?

[maark]

I have setup the subnet on lightspeed under authentication - source exemptions. Is there anywhere else I need to set it?

Am stumped on this one unless there is something on the core switch access lists that capita setup but am struggling to see anything.

Going to to try wireshark when i get chance to see if it give any clues.

[Prevention]

I believe because it's a BYOD Subnet then the end devices won't have the lightspeed agent so you need to put the IP Range in - Source Exemptions

Edit - Then you need to add it so a Group for base filtering

 

Edited March 11, 2019 by Prevention

[maark]

yes have done that but still missing something - router is showing http://lightspeed...... rather than 10.3........ on phone connected to this subnet

have tried connecting a laptop direct into core switch with a port untagged to this subnet and get same error - this rules out config issues with wireless, other switches etc.

[Prevention]

Apologies completely skimmed past your last reply! What do you mean by the Router is showing lightspeed?

[maark]

if connect an android phone to our guest network or staff device network under manage router in phone settings it shows http//:10.3 etc and internet works ok

if I connect android phone to BYOD under manage router it shows http://lightspeed.schools etc rather than the 10.3 address - I also get a message about Internet may not be available so it is not getting through to the 10.3 gateway though you ping that gateway ok from laptop

[Prevention]

Sorry I really don't understand.

Manage Router in Phone Settings? Are you saying the default gate way is usually 10.3 but on a BYOD device it's showing the default gateway as lightspeed?

[maark]

yes that is what i am saying this is the difference between working range and non-working.

On a laptop connected to BYOD it shows the gateway as 10.3..... but does not work on internet

on a phone under connections, manage router it is showing as http://lightspeed.schools...... - don't why it is picking this up as router/gateway instead of the 10.3 address - lightspeed tell me it is a transparent bridge so should not need any settings to let traffic through