⭐The wireless client disconnects abnormally and there is no network after reconnecting anymore

Wireless client ------AP-----AC------Core------Firewall

1.Client disconnection problem The customer said that the Clients have a disconnection problem, the specific phenomenon is that just connected to the wifi, about 2-3 minutes will be disconnected. After disconnection, the client information cannot be seen on AC. This problem occurs in 90% of the devices brought to Mexico by Chinese people, and rarely occurs in local devices. The main devices involved include Apple cell phones, Windows computers, and MAC computers have never had this problem. 

2.Customer feedback that some clients have no network when accessing wifi. At the beginning, other engineers did not reproduce this problem during troubleshooting. When troubleshooting problem 1, we found by chance that this problem occurs in a PC that often drops out of the network. Unlike the problem of problem 1, the PC can get the address and keep it, and the AC can also see the status of the terminal (ip, channel, etc.) continuously. The PC can ping through the gateway (core device), but cannot ping through the external DNS 8.8.8.8, and the terminal cannot access the Internet. Checking the wired side no obvious faults were found. Another test windows PC placed on the same table, connected to the same AP, connected to the same SSID, was able to ping through 8.8.8.8, and the core device was also able to ping through 8.8.8.8.

1.Wireless side

Checking the reason for client drop, the reason code is 5025, which means it is the client disconnecting itself. It is not the wireless AC kicking out the terminal. I tried creating a test service template and adjusting the channel and authentication method, but the problem persists. The wireless client can connect to the SSID but cannot access the internet and disconnects after some time.

Since some clients don't disconnect but still can't access the Internet, we tried pinging the gateway successfully but pinging DNS 8.8.8.8 was not successful. So we suspect that the problem lies in the firewall.

2.Firewall side

We found a large number of Chinese clients with IP addresses in the blacklist.

The reason they are blacklisted is the action of the url filtering feature

We found there is a function which can make Client-IP to black-list

Modify the url-filter action.

It usually be drop, not blacklist