0

Our company has a guest wireless network for auditors, contractors, etc. to use when onsite. This wireless is meant to be an external only network, so it only touches the wireless controller, and a DNS server. The DNS server is only meant to provide the IP of the capture page on the WLC. After that, all DNS requests get forwarded to OpenDNS

Traffic flows like such: Client->DHCP->Wireless Controller(WLC)->Capture Page-> DNS-> WLC ->MPLS.

Our WLC is a Cisco 5510, which cannot host its own DHCP. The capture page works by redirecting any traffic to the DNS hostname specified on the controller, and then requiring credentials.

The issue we are running into is DNS requests failing. All active domain machines seem to work fine (keep in mind that this DNS server is not apart of our domain). Our auditors came in today to try and connect, but the DNS request was failing. When attempting to get an IP from nslookup, I received a "non-existent domain" error.

To try and replicate, I got a fresh load of windows, no domain affiliation, and attempted to connect to this network. I received no errors, and the DNS request worked fine. To further troubleshoot, i added a domain suffix to the NIC and checked the box to ensure it appended that suffix to DNS requests. Unexpectedly, that was still working.

Based on what troubleshooting I did on the auditors machine, I believe the DNS request from the wireless controller uses no suffix. this is because:

Requests to "WLC" fail with the non-existent domain error.

Requests to "WLC.domain.com" succeed.

I do have option 15 in DHCP enabled with "domain.com" (our domain name) but I have not tried removing that from DHCP. Other guests are active on the wireless and I do not want to break DHCP.

Another thing: In DNS, the forward lookup zone is "domain.com" and the A record FQDN is "WLC.domain.com". The reverse lookup zone is 1.1.1.adr as the capture page is on 1.1.1.1

I tried adding a new forward lookup zone with a wildcard, so it became "wlc.*" but that didnt fix it

The DNS server is hosted on a Server2012R2 box. The WLC is a Cisco 5510 as noted above

  • Can you add clarification? Are you saying DHCP works as expected when you connect to the wireless network? What's your IP scheme for wireless network? Is it on the same subnet as the DNS server? Are you able to ping the controller? Are you able to ping the DNS server? Are you able to ping a public DNS (8.8.8.8 or 4.2.2.4)? What happens if you manually set the DNS server on client to a public DNS (are you able to reach the internet)? – CIA Jun 19 '18 at 23:41
  • The issue is with DNS, not DHCP, but all of this is assuming that i am already on the wireless, just not authenticated with the WLC. The capture page on the WLC does not allow any traffic through, even while connected, until authenticated on the WLC. Wireless is 172.16.67.0/24. The DNS server is the .3 address and the .1 is the router address. Manually setting the DNS servers doesnt work per above requirements – colbyt Jun 20 '18 at 14:46
  • I'm not sure I'm reading the question correctly: why would you expect nslookup WLC to work when the DNS record you're looking for is WLC.domain.com ? It seems to me that unless domain.com is in the client's DNS suffix search list, which is unlikely for a client belonging to another organization, that lookup should fail. – Harry Johnston Jun 21 '18 at 0:59
  • ... if what you're actually trying to do is to get your DNS server to serve out a host record for wlc. (i.e., no suffix) then I imagine someone will know how to do that, but you may need to rewrite a bit to make it clear that this is in fact what you're wanting. – Harry Johnston Jun 21 '18 at 1:11
  • Thanks Harry, that is pretty much exactly what I am looking for. I dont know why it works on some computers, because like i mentioned above, a fresh load of windows (not domain) will return a value for WLC. – colbyt Jun 21 '18 at 14:39
0

Another thing: In DNS, the forward lookup zone is "domain.com" and the A record FQDN is "WLC.domain.com". The reverse lookup zone is 1.1.1.adr as the capture page is on 1.1.1.1

Did you realize that 1.1.1.1 is a valid public IP and is actually a public DNS service by Cloudflare and APNIC ?

  • I did not until now. The capture page was on that IP well before I started and it worked until now. The only difference being that the old guest wireless could touch internal services whereas the new wireless is completely segregated – colbyt Jun 20 '18 at 14:50
  • The service from Cloudflare is quite new, I don't know how did APNIC used the addresss before. Anyway, it might be that before you did all the resolve internally without forwarding to 1.1.1.1, so you never saw the problem. Removing the local resolution and isolating the WiFi might make your queries go to the public 1.1.1.1 searching for the internal domain for the hotspot, and thus, failing. Try and change the IP address for the hotspot for a private one and see what happens. – Leo Jun 20 '18 at 18:03
  • I will have to schedule some downtime for that fix but I will attempt it and let you know – colbyt Jun 21 '18 at 14:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.