Options

VLAN for Guest Wifi - No internet access

I am asking for a little help from the Watchguard user community. I have a new Watchguard M290 and a few Ubiquiti wireless access points. I would like to setup a VLAN configuration to allow both a public and private wifi network. I have everything working EXCEPT internet access on the public wifi network. I need a pointer to head me in the correct direction.

The trusted network is running on VLAN 1 untagged.
And the public wifi network is running on VLAN 11 tagged.
I have added the public wifi network to the proper firewall policies. (I think.)

Clients on the public wifi network pick up a DHCP IP address and the proper gateway IP address to the Watchguard on the VLAN.

But clients on the public wifi network do not have internet access. When I try to run a ping command to an external IP address, I get the error message "no route to host."

If anyone can help, I would appreciate it. Also, I am sure that I need to provide more information, just let me know and I will do so.

Thanks.

Comments

  • Options
    What do you see in Traffic Monitor when this access is tried?
  • Options

    Nothing. No entries in Traffic Monitor for the guest wifi VLAN traffic.

  • Options

    Could this be a trunk issue - the connection between the switch & the firewall?

    Have you connected this to a firewall interface defined as a VLAN interface?
    If so, have both VLANs been defined on it?
    And has at least one of them been marked as tagged?
    If so, has the tagged VLANs on the switch port which connects to the firewall also been marked as tagged or set as a trunk connection?

  • Options

    Also, what is providing the DHCP addrs to the guest wifi VLAN? The firewall?
    If so, then that suggests that that the VLAN connection to it for the guest wifi VLAN is correct, but doesn't explain the connection issue.

    For problem resolution - Add an Any policy From: the guest wifi VLAN To: Any.
    Turn on Logging on it to see entries in Traffic Monitor for packets allowed by this policy.
    Move it to the top of the policy list.
    If you don't have Internet access then, seems like a switch issue.

  • Options

    I agree with that. That is an excellent suggestion. I will try it!

Sign In to comment.