New WAX610 - Internet connectivity for laptops but not smartphones

[stewcoarchives]

I just installed a WAX610, hardwired to a nearby, new Netgear GS308E switch in a new office.  The switch connects to the building's router, somewhere in the building.  The AP has Internet connectivity, and speed tests are in the 900Mbps range.

I configured a simple guest SSID on the WAX610, taking all the default values (other than having no password).

All laptops that connect to the WAX610 have Internet connectivity, but all smartphones do not.  Smartphones will connect to the AP, and will get an IP assigned in the same 192.168.1.x range as the laptops that connect to it, but the smartphones don't have Internet connectivity.

What settings on the AP must I change so that smartphones connecting to the AP have Internet connectivity just like the laptops do?

[schumaku]

---

@stewcoarchives wrote:

I just installed a WAX610, hardwired to a nearby, new Netgear GS308E switch in a new office.  

I configured a simple guest SSID on the WAX610, taking all the default values (other than having no password).

All laptops that connect to the WAX610 have Internet connectivity, but all smartphones do not.  Smartphones will connect to the AP, and will get an IP assigned in the same 192.168.1.x range as the laptops that connect to it, but the smartphones don't have Internet connectivity.

---

For completeness, please report the current installed and active firmware version on this WAX610.

Anything odd or strange when checking the WAX610 Logs?

While hard to imagine DHCP works, but the Internet access does not, please check the default settings for this SSID in regard to OWE, OWE Transition Mode, PMF, and the network mode is bridge (or NAT). Here how Insight does set such a password-free SSID:

[stewcoarchives]

Thanks.  I upgraded the firmware from V9.6.0.7 to the newest-available, which is V10.6.0.7, but that did not resolve the issue.

Based on your settings recommendations, I then enabled Enhanced Open, as well as Allow Devices to Connect with Open.  (Addressing and Traffic was already set to Bridge).  But changing these settings had no effect - laptops still connected with Internet, and smartphones still connected and got an IP assigned, but with no Internet.

I then examined the WiFi settings on one of the (Android) smartphones connected to the SSID.  I, admittedly randomly, changed the setting for MAC address type from Randomized MAC to Phone MAC, and the smartphone immediately had Internet connectivity through the SSID.

[Retired_Member]

Latest software for your WAX610 is 10.6.1.1 and not 10.6.0.7

https://www.netgear.com/support/download/?model=WAX610

[stewcoarchives]

I spoke too soon.  Smartphones are still failing to have Internet connectivity after connecting to this new WAX610.

I had enabled Enhanced Open per previous recommendation, and had confirmed that Addressing and Traffic was already set to Bridge.

Upon arriving in the office every day, my laptop connects to the AP, immediately has Internet connectivity, and never loses it.  My smartphone connects to the same AP, but invariably gets the "Connected without Internet" error seconds later.  Sometimes the problem disappears and the phone gets connectivity, but usually does not.

As I have no prior experience with configuring APs, I'm hopeful someone can offer a suggestion of what to try next.  While I had a career in IT, I never had to deal with networking equipment.

[stewcoarchives]

I would also add that my AP firmware is at V10.6.1.1

[stewcoarchives]

Log uploaded to

https://drive.google.com/file/d/1gmht8Z82YrjeQQ047VLbZ-pRV4G3Kjuk/view?usp=sharing

[stewcoarchives]

Months later and this problem is not resolved.  All laptops connect to the WAX610 just fine, get a 192.168.1.x IP address, and have uninterrupted Internet connectivity.

All smartphones connect to the same SSID, get a 192.168.1.x IP, and immediately receive a "Connected without Internet" error message that never resolves.  Rebooting the WAX610 does no good.  Changing the smartphone from a randomized MAC to a phone MAC does no good.

Not sure if a warranty return is now in order, or a different vendor.  I appreciate the help thus far given, but it seems no one else is having this type of phone-only blockage, so perhaps it's the hardware.

[schumaku]

---

@stewcoarchives wrote:

Changing the smartphone from a randomized MAC to a phone MAC does no good.

---

This is just to avoid overloading the DHCP server IP address pool, nothing else - matter of fact you have nothing to hide to yourself what you already know anyway.

Assuming the message does come every time, on each new connection established.

First thing I would suggest is to forget the network. On an iPhone there is an amber text stating "No Internet Connection" click on the Wi-Fi settings section, the (i) field, and tap on the Forget This Network (correct Apple language). On Android it's typically a wrong password message, there go to the Internet connections, and tap the [Forget] with the wastebasket icon. Then re-add the Wi-Fi config.

This happens when changing the AP security eg. from WPA2-Personal to WPA3-Personal or  WPA2-/WPA3-Mixed Mode after the connection was configured on the smart phones.

Sometimes, it's required to Reset the Network Settings in the Reset menu, and re-configure accordingly.

That's everything coming into my mind on these issues.

[RennaD]

Hello @JulienCM,

And welcome to the NETGEAR Community! 🙂

Aside from what @schumaku suggested, can you check if there is any type of ACL configured, either on the WAX610 or the router? For WAX610 please see page 222 of the link below:
https://www.downloads.netgear.com/files/GDC/WAX610/WAX610_WAX610Y_UM_EN.pdf

If the router has WiFi can you try and connect to that SSID and check to isolate?

Have a lovely day,
RennaD
NETGEAR Team

[stewcoarchives]

Neither the WAX610 nor the router have an ACL implemented.

The router does have WiFi, and smartphones that connect to its SSID have Internet service, always.  Trouble is, the router is on the main floor of our building and we're in the basement - that SSID isn't even visible to us when our devices in in the basement. 

I installed the WAX610 in the basement to get WiFi service down here.  It's hardwired to a Netgear GS308E that in turn connects to a router port upstairs.  Our laptops connect to the WAX610 and always have Internet, but smartphones that connect to the WAX610 get 'Connected without Internet.' 

I can do a network reset on my Android and sometimes it might connect briefly, but the next day I come to the office, it's back to 'Connected without Internet.'

No fancy configurations on the WAX610 - just the OWE feature previously suggested.

[schumaku]

The OWE is was just a modest proposal for providing secured (encrypted) guest-like (unauthenticated) access while having no password requirements for the wireless clients.

The GS308E with it's WAX610 is connected how to the Internet, resp, the LAN of your primary router - and not to some cable modem or the like?

I don't come behind why you state the smartphones don't get Internet access, while the random computers or PCs connected to the GS308E as well as wireless PCs get LAN and Internet access through the router, while these magic unknown smartphones don't. A possible explanation is already on the table: Should you had configured the smartphones for using a WPA2-PSK/-Personal but the WAX610 (and your primary router Wi-Fi?) is configured to WPA3-PSK/-Personal you might have to forget the existing Wi-Fi connection to this network name (SSSID) and re-assign it to the WAX610-served SSID. 

Of course, assuming everything is on one network, one one VLAN, and no misconfiguration linking the WAX610-served SSID to a non-exiting or inactive VLAN.

Would you mind to draw on a sheet of paper what your network ideas are, nd how things are connected, with as much details as possible, and post this drawing as an attachment along with a future reply?

Last but not least, I can't guarantee that all your unknown, unspecified Smartphones able to deal with the OWE. Why not use for clear security management a wireless SSID with a password instead? Looking again over the complete thread, it appears we're looping now.

[stewcoarchives]

I have attached a simple drawing of the network as I understand it (I have no physical access to the router on the main floor, though I can log into it).

I've just tried something that works for my (Android) smartphone, but it's not an ideal solution for our daily visitors:

(1) I created an SSID on my WAX610 with WPA2/Personal security, leaving all other settings at their default values.  I connected to that SSID on my smartphone, keeping the DHCP default setting, and received the ever-present "Connected without Internet" failure message.

(2) I logged into the router upstairs and configured a static IP for my smartphone's MAC address (phone MAC, not randomized MAC).

When I reconnected my smartphone using the new, password-required SSID, and configured my phone's connection for that static IP, my phone had Internet connectivity.

I would prefer a solution, however, that allows open access to my visitors' smartphones without having to reserve an IP for their phone's MAC address.

[aabecst]

Let me try to paraphrase the issue : The customer is experiencing a problem where their phone is unable to connect to the network, despite the laptops being able to connect without any issues.

Setup :

Router====Switch===WAX610

• The WAX610 SSID has no MAC filters.
• The customer cannot access the router and cannot manage it.
• Laptops connect to the Internet, and phones do not get IP addresses from the router.
• The customer suspects a Mac filter on the router may be stopping phone network access.

One possible solution is to use NAT-Mode-SSID for WAX610. This means that the WAX610 SSID will be allowed to pass traffic to the Internet by the router, potentially resolving the network access issue for the phones.

This will work as long as WAX610 is allowed to pass traffic to the Internet by router.

if you are using WAX610 as a standalone, please check page 215 here

https://www.downloads.netgear.com/files/GDC/WAX610/WAX610_WAX610Y_UM_EN.pdf

If you are using Insight Cloud Manager. you can do the same via

Organization->location->wireless->settings->SSID settings.

Now the WAX610 will start acting as the basic router and will give IP address to wireless clients.  Useful for one AP deployments where roaming is not an issue.

[stewcoarchives]

I would correct a couple of incorrect statements, if I may:

- I am able to log into the router (thanks to it still having a default password); there are no MAC filters present in the router.

- Smartphones can connect to the SSID and are assigned an IP address from the router; however, they don't have Internet access.  The message "Connected without Internet" appears on my Android after I connect to the SSID.

[RennaD]

Hi @stewcoarchives,

Were you able to configure NAT-Mode-SSID as suggested by @aabecst? Did it help resolve the issue?

Sincerely,
RennaD
NETGEAR Team

[schumaku]

The NAT-mode-SSID does not make a difference or fix anything magically for users experiencing the "Connected / No Internet Access" on recent Android devices.

[hnagaraju]

Current topology:

Router(DHCP server)====L2 Poe Switch====AP ~~~~wireless clients

Normal Open SSID.

The issue is that some clients get IP addresses, and others do not.

We can rule out any issues on the DHCP server by moving the DHCP server to AP.

Let try this :

Router(DHCP server)====L2 Poe Switch====AP  (DHCP server) ~~~~wireless clients.

Normal Open SSID. Now, the AP gives out the IP address.

Another suspect:  Is there any Captive portal enabled on the SSID?

If so, you get the mobile phones to pop up the captive portal splash page,

open the browser on the phone and type http://www.msn.com

(note http:// and not https://)

Please open a support case via chat if none of these helped. 

NETGEAR can help you better by looking at network topology and AP configuration files.

[schumaku]

---

@hnagaraju wrote:

Let try this :

Router(DHCP server)====L2 Poe Switch====AP  (DHCP server) ~~~~wireless clients.

Normal Open SSID. Now, the AP gives out the IP address.

Another suspect:  Is there any Captive portal enabled on the SSID?

If so, you get the mobile phones to pop up the captive portal splash page,

open the browser on the phone and type http://www.msn.com

(note http:// and not https://)

---

Not sure what @hnagaraju expects from letting the OP try http ... considering msn.com does almost certainly force a https redirect (https and localized site) anyway?

Much better would be using http://neverssl.com/

  

[stewcoarchives]

It's not accurate that only some clients get an IP address.  All clients can successfully authenticate to the WAX610, using the open SSID, and all receive an IP address from the router.  I can see the devices connected to the SSID and can see them in the router's device table with their assigned IP address.  But for some reason, smartphones get 'Internet not available' errors upon authenticating to the WAX610 and getting their IP address from the router.

I was out-of-office last week, but before I left I logged into the router (not the WAX610) and assigned a reserved IP address to the physical MAC address of my smartphone.  (A previous commenter erroneously stated that I had no access to the router, despite my having stated that I did have remote access but no physical access).   I then configured that same IP in my phone's saved WiFi connection to the open SSID on the WAX610.

Upon arrival in the office today, my smartphone connected automatically, as usual, but this time it also had Internet service, which is a first.

If this workaround turns out to be repeatable, I'm OK with reserving IP addresses for the smartphones of the people who work here in the office.  Our visitors typically rely on our WiFi only for their laptops, and that connectivity has always worked from the time that the WAX610 was installed.

[stewcoarchives]

Is it possible that my issue is not with the WAX610, but the router above it?  I've found a path to success that is repeatable, but I don't understand it.

My Android smartphone has always failed to have Internet connectivity after it successfully authenticates to the WAX610 and receives an IP address from the router. 

Based on that behavior, I logged into the router and reserved an IP address for my smartphone's physical MAC.  That did not improve the situation - my smartphone does get that assigned IP address from the router upon authenticating to the WAX610, but still does not have Internet connectivity.

But if I then log into the router, and use the router's internal Ping Test utility to ping the IP of my smartphone that has just connected to the network, suddenly my smartphone has Internet connectivity.

Why would issuing a ping from the router to my smartphone suddenly make my phone have Internet connectivity?

[stewcoarchives]

And to test this behavior further, I removed the IP reservation in the router for my Android's physical MAC address, then switched my Android's WiFi connection to the WAX610 SSID from Static back to the DHCP default.

My Android reconnected to the SSID and immediately threw the typical "Connected without Internet" error that has plagued me for months.  I noted the new IP address that my Android had just gotten from the router, then pinged that IP address from within the router.  My Android instantly started having Internet access.

Why does my smartphone require a ping from the router to get to the Internet, but our laptops in the same office do not?

[Pramendra]

Hi @stewcoarchives ,

Is the SSID to which clients are connecting is a "Guest or Captive Portal" SSID? In this case, a pop up should come up for authentication.

Are you connecting laptops and mobile devices to same SSID or different SSID?

Thanks!

Pramendra

[stewcoarchives]

The single SSID to which laptops and phones are connecting is not a captive-portal SSID.  The SSID is unsecured.  All devices (laptops and smartphones) immediately authenticate to it and receive an IP address from the router, but smartphones receive the 'Internet not available' error message while laptops have immediate Internet access.