I was on a train today, and they were offering free Wi-Fi but despite me being able to connect, I had no internet access. This has happened a few times to me and it’s when I need to connect to a captive portal to get internet access, then no captive portal ever appears.
Note: A captive portal is just a pop up window that you usually see on ‘Free‘ wifi services, so you can ‘Pay‘ for connection, by giving them your details (name, email etc).
No Captive Portal: Solution
Now I could connect with my Android phone and that has a hotspot so I knew the problem was on my Mac, and I had my work iPhone in my bag I could also connect to that and get 4G. But I wanted to bottom out the problem in case I was ever stuck.
Open your network preferences > Select the Wifi connection > Advanced.
Firstly let’s try the obvious, locate the entry that matches the SSID you are trying to connect to , and Delete it > OK > Try again?
In my case the problem was being caused by the fact I had static DNS entries (Google’s DNS servers), this is why the captive portal was never being shown. You cant do a DNS lookup, before you have internet access, and if your DNS servers are on the internet, you can’t resolve the private URL of the captive portal!
Delete all the static DNS entries (dont panic! you will get the correct one dynamically allocated to you.) Once you’ve removed them all > OK > Try again.
Fixed.
Related Articles, References, Credits, or External Links
Note: May also be asked as, Client VPN connects but cannot ping anything behind the Firewall.
KB ID 0000199
Problem
If I had a pound for every time I’ve seen this either in the wild, or asked in a forum, I would be minted! In nearly every case the problem is NAT related.
In most cases, If the person launching the VPN client is behind a device that is performing NAT, (Home Router, Access Point, Firewall, etc) then the device will BREAK the NO NAT, or “nat 0” on pre 8.3 firewalls. (that’s the command that says “DONT change the address of my remote VPN client as it passes up and down the VPN tunnel).
Update 08/09/16: Due to a bug, I found an exception to this problem being broken NAT (see below)
Solution
Enable nat-traversal, this is a global configuration setting and will not affect any other site to site, or client to gateway VPN’s you are currently running.
Then go to enable mode > Configure Terminal mode > and issue a “crypto isakmp nat-traversal 20” command >Then save the change with a “write mem” command.
[box]
User Access Verification
Password:
Type help or '?' for a list of available commands.
Petes-ASA> enable
Password: ********Petes-ASA# configure terminal
Petes-ASA(config)# crypto isakmp nat-traversal 20
Petes-ASA# write mem
Building configuration...
Cryptochecksum: 79745c0a 509726e5 b2c66028 021fdc7d
7424 bytes copied in 1.710 secs (7424 bytes/sec)
[OK]
Petes-ASA#
If you can find this in the ASDM post version 7 – You are better than me!
Navigate to > Configuration > Remote Access VPN > Advanced > IKE Parameters > Tick “Enable IPSec over NAT-T” option > Set the “NAT Keepalive” to 20 seconds > Apply > File > Save running configuration to flash.
I’ve done that and its still not working?
On a Firewall Running 8.3 (or Newer)
1. On the firewall issue a “show run nat” command > Make sure there is a NAT statement that has static (the network behind the ASA) to static (the remote VPN network). I’ve highlighted it below.
[box]
User Access Verification
Password:
Type help or '?' for a list of available commands.
Petes-ASA>enable
Password: ********
Petes-ASA# show run natnat (inside,any) source static obj-10.254.254.0 obj-10.254.254.0 destination static obj-10.253.253.0 obj-10.253.253.0 route-lookup
!
object network obj_any
nat (inside,outside) dynamic interface
object network Media_PC
nat (inside,outside) static interface service tcp 123 123
!
nat (outside,outside) after-auto source dynamic VPN_Pool interface
PetesASA#
[/box]
2. Make sure the correct network(s) are in the correct groups.
On the firewall issue a “show run nat 0” command > take note of the access-list name.
[box]
User Access Verification
Password:
Type help or '?' for a list of available commands.
Petes-ASA> enable
Password: ********
Petes-ASA# show run nat 0
nat (inside) 0 access-list NO-NAT-TRAFFIC
nat (inside) 1 0.0.0.0 0.0.0.0
[/box]
In this example mines called NO-NAT-TRAFFIC (cause I like to keep things simple) yours can be called anything (inside_nat0_outbound is the norm if you used the ASDM to set up the VPN).
Now make sure that you have the correct addresses in that access-list, issue a show run access-list {name} command.
[box]
Petes-ASA#show run access-list NO-NAT-TRAFFIC
access-list NO-NAT-TRAFFIC extended permit ip 10.254.254.0 255.255.255.0 10.253.253.0 255.255.255.0
access-list NO-NAT-TRAFFIC extended permit ip 10.254.254.0 255.255.255.0 10.252.252.0 255.255.255.0
Petes-ASA#
[/box]
Above we have two subnets that are going to be exempt from NAT, they are 10.253.253.0/24 and 10.252.252.0/24, if the range of IP addresses your remote clients are using is NOT on this list you need to add them.
If you don’t know what addresses they are supposed to be using, then issue a “show run ip local pool” command.
[box]
Petes-ASA#show run ip local pool
ip local pool IPSEC-VPN-DHCP-POOL 10.253.253.1-10.253.253.5
ip local pool SSL-VPN-DHCP-POOL 10.252.252.1-10.252.252.5
Petes-ASA#
[/box]
Again I’ve got a sensible naming policy – so we can see what my pools are for, to see what pools are being used for what, issue a “show run tunnel-group” command.
[box]
Petes-ASA# show run tunnel-group
tunnel-group IPSEC-VPN-GROUP type remote-access <<< Here's my IPSEC VPN's
tunnel-group IPSEC-VPN-GROUP general-attributes
address-pool IPSEC-VPN-DHCP-POOL <<< And here's my matching DHCP scope (IPSEC)
authentication-server-group PNL-KERBEROS
default-group-policy IPSEC-VPN-POLICY
tunnel-group IPSEC-VPN-GROUP ipsec-attributes
pre-shared-key *****
tunnel-group SSL-VPN-POLICY type remote-access <<< Here's my SSL VPN's
tunnel-group SSL-VPN-POLICY general-attributes
address-pool SSL-VPN-DHCP-POOL <<< And here's my matching DHCP scope (SSL)
authentication-server-group PNL-KERBEROS
default-group-policy SSL-VPN-GROUP-POLICY
tunnel-group SSL-VPN-POLICY webvpn-attributes
group-alias PNL enable
Petes-ASA#
[/box]
If any of yours are missing then change accordingly.
BUG (08/09/16)
Had this problem again recently, and after staying on the phone to TAC until 03:00, it turned out to be a bug in the SFR (FirePOWER service module) code. That was causing the firewall to silently drop the AnyConnect traffic. So debugs showed nothing, and packet captures were empty. Fixed by removing ‘sfr fail-open’ from the firewall and upgrading the code by re-imaging the SFR module.
Related Articles, References, Credits, or External Links
