After XG310 Install Windows 7 / 10 shows "No Internet Access" but internet works fine

Hi Allan, since this is not a common problem, I would say double check your DNS and web access settings. Here is an old technet article that I found but the mechanism that checks for connectivity is still the same in windows 7/8/10. Let us know if this works for you.

I mentioned it seems common since I've seen other Sophos users with the same issue (I.e.: https://community.sophos.com/products/xg-firewall/f/firewall-and-policies/80595/no-internet-access-notification , https://community.sophos.com/products/unified-threat-management/f/web-protection-web-filtering-application-visibility-control/44586/windows-7---no-internet-access-icon-if-http-proxy-enabled-in-transparent-mode , etc) when I was troubleshooting my issue.  But I can't figure it out.

Everything "works" fine.  Internet access is fine, DNS works, etc.  I have a standard web access rule allowing HTTP and HTTPS with the "Default Workplace Policy" applied. 

I once did some consulting work at a place that had a Astaro v6 with transparent authentication that had the exact same issue (Windows XP back then) and I couldn't figure it out but since it didn't seem to break anything I told them to ignore it.

Does no one else have this issue or is no one using the transparent suite for authentication?

-Allan

We don't restrict access by user either. We tried to use it so we could get more granular reporting based on the user and not the IP but even for use, setting it all the way down to 1 still cause a small issues. Turning it down to 1 does not give the firewall enough time to learn who the user is so it almost as if you don't have the feature enabled.

For your DMZ, I would exclude that subnet in the STAS application itself. That seems to work most of the time but it's not 100%. I was still seeing some dropped packets from our DMZ WIFI network saying identity was the cause.

system auth cta unauth-traffic drop-period 40 must be done from the device console which is option 4 on the main menu. The other command is done from the advanced shell of the firewall.

Hope this helps.

Mike

Yes it does, thank-you.  Was trying to do the drop-period command from the advanced shell and it of course wasn't working. 

I'll try it with 30 and see if its better.  Although anything would be better at this point to stop users from calling and saying they have no internet access then asking them if they can get to google and when they say yes telling them they have internet access and trying to explain whats going on over and over.

-Allan

I feel your pain. That article wasn't out when I had the problem and support "couldn't find anything wrong" until I started doing drop packet captures and showed them the firewall was at fault. We only want to use STAS to help identify the users. I wish they would come up with a way to not block users like this when the firewall cannot identify them. Even at 30 seconds, that is awhile to wait when you have someone trying to access something right then.

Mike

Hi Allan,

I had a similar problem, but it wasn't STAS for me.  Windows does a lookup to a URL to determine if internet access is working.  The XG was blocking this request as a virus.  I needed to add the following to a web exception rule and disable malware scanning:

^([A-Za-z0-9.-]*\.)?msftconnecttest\.com/

This is for Windows 10/Server 2016.  I do not recall what the URL is for Windows 7.

Thanks,

John

The regex for Windows 7/Server 2008 R2 is ^([A-Za-z0-9.-]*\.)?msftncsi\.com/.

I did both but unfortunately that didn't help in my case but give that a try to Allan.

I added both exceptions in but it also didn't seem to help for me.  Most Windows 10 machines and Server 2012 are clearing the error within a hour, most Windows 7 machines are never clearing.


I also found this that's related but not related: https://support.umbrella.com/hc/en-us/articles/230900948-Umbrella-Roaming-Client-Microsoft-Windows-Limited-Network-Connectivity-Warning-Yellow-Triangle- along with this: http://blog.superuser.com/2011/05/16/windows-7-network-awareness/ in which someone created their own "internet check server".   The first didn't seem to help, the second could potentially but I don't really want to have to create and host a website for the check to work especially when clients leave the network and might be affected coming back in to check status.


-Allan

Have you tried temporally disabling STAS in the firewall? That will at least isolate if it indeed is that same authentication issue we were seeing. Also restart Network Location Awareness in services to clear the exclamation point error and see if it comes back while STAS is disabled on the firewall.

Mike

I will this weekend, gonna do some server migrations so I'll have downtime waiting for files to transfer, and I'll report back.

My server migrations went horrible (12 hours to get a exchange server back up that was simply moved between VM hosts....) so I didn't have time to test this.  I'll try again this coming weekend or after hours to disable STAS and retest

after a lot ot troubleshooting still unable to solve this problem 

after a lot ot troubleshooting still unable to solve this problem 

See this thread: Invalid Traffic to msftconnecttest.com with Could not associate packet to any connection.