This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Some clients not connecting

Hi All

I have just deployed a wireless network that seemed to work for me when testing, however it has come about that some clients seem to connect and get net access, others dont. There arent any rules to say some should and some shouldnt.
So far it seems as though the correct pass is used, computers report connected but no access.

Where can I find logs about attempted connections etc for wireless?

Cheers

This thread was automatically locked due to age.

0 Keyur over 5 years ago

Hi GregBuff

The clients who are not able to access the Internet, are able to get DHCP IP? You can use packet capture utility to capture traffic - https://community.sophos.com/kb/en-us/123189
Cancel
Vote Up 0 Vote Down

Cancel
0 GregBuff over 5 years ago in reply to Keyur

Hi Keyur

Unfortunately the user I was on the phone with did not have admin credentials for their client so troubleshooting was difficult to say the least.

We did manage to determine no DHCP IP was assigned but they couldnt set an IP to see if it was only that.
They did disconnect/reconnect several times and we rebooted the laptop 3 or 4 also.
Strangely different parts of windows was saying not connected to any network... so I wonder if we did actually associate successfully or not.

They ended up turning on the old AP (tp-link) and it worked straight away.

I will try and test myself later this week. Any info, particularly wireless logs you can find would be great.
Cancel
Vote Up 0 Vote Down

Cancel
0 rfcat_vk over 5 years ago in reply to GregBuff

Hi,

as a matter f interest what is the APyour having connection is with?

The issue sounds very much like a VLAN issue on the phone or the PC/laptop.

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 GregBuff over 5 years ago in reply to rfcat_vk

Hi Ian

It's an APX120.

My initial thoughts were also vlan or fw rule or user auth but there isnt config as such.

I have come across an article which mentions
tail -f /var/tslog/wc_remote.log

https://community.sophos.com/products/xg-firewall/f/sophos-xg-firewall-general-discussion/76933/troubleshoot-wifi-clients-associating

So I'll check that out shortly.

Another article mentions fast roaming and Intel 8265 cards having issues associating, which is also something i'll check out
https://community.sophos.com/kb/en-us/134351
Cancel
Vote Up 0 Vote Down

Cancel
0 GregBuff over 5 years ago in reply to Keyur

Hi Keyur

The clients are not able to get DHCP. I did a capture and found that it was blocked.

Time In interface Out Ethernet type Src IP Destination IP Packet type Ports [src,dst] Rule ID Status Reason
2020-04-30 21:58:48 [WifiName] IPv4 0.0.0.0 255.255.255.255 UDP 68,67 0 Incoming
2020-04-30 21:58:39 [WifiName] IPv4 0.0.0.0 255.255.255.255 UDP 68,67 0 Violation Local_ACL

There is an XG with built in wireless and 2x APX120. The clients connected to the APX120's do not have any issues, the clients connecting to localwifi0/XGw get blocked.
At first I thought it was clients on the APXs but in fact they are fine!

Strangely, there is another site with very similar config and this isnt an issue (but roaming between localwifi0 and APX is)
Cancel
Vote Up 0 Vote Down

Cancel
0 Keyur over 5 years ago in reply to GregBuff

Hi GregBuff

Could you please try to capture tcpdump on port 67 and 68, please log in to devise console and execute console>tcpdump 'port 67 or 68 -E and check if you are getting MAC address of the devices requesting for DHCP. for Advanced Shell - tcpdump -nei any port 67 or 68
Cancel
Vote Up 0 Vote Down

Cancel
0 GregBuff over 5 years ago in reply to Keyur

Havent had a chance to log in for tcpdump, but in the packet capture it was listing the correct MAC on those entries above.
Cancel
Vote Up 0 Vote Down

Cancel
0 GregBuff over 5 years ago in reply to Keyur

Hi Keyur

Is it not possible to log into console via Central? I've got to the password prompt but it keeps saying auth failed...

I tried the command on a different site and it doesnt work and wanted to check syntax of tcpdump 'port 67 or 68 -E (at device console not adv shell)- comes back with usage details, dropping the -E seems to work however.

As I couldnt ssh into the problematic site I had a look around other possible configuration issues and did find that Fast Transition was enabled. Checking the help there is a note that it is incompatible with legacy APs and APXs - is the XG115w internal AP considered a legacy AP?

I'm wondering if this is an issue where clients are on one AP and are roaming to another AP and the DHCP side of things is getting lost as it thinks the address is already assigned? APX to APX seems ok, but AP to APX or APX to AP seems to result in loss of connection or even unable to connect/maintain connection to the SSID.

Edit:

These old articles seem to be similar to what I'm experiencing...

https://community.sophos.com/products/xg-firewall/f/wireless-networking/91917/clients-can-not-log-in-to-wifi-broadcasted-by-ap50-but-to-same-wifi-broadcasted-by-xg115w-internal-wifi-ap
Unless the 3 APXs are all faulty (bought at same time) then there must be something else at hand...

https://community.sophos.com/kb/en-us/123952
No static DHCP leases assigned.

https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/112358/fw-internal-traffic-blocked-on-wifi-access
Seems the most relevant?
Cancel
Vote Up 0 Vote Down

Cancel