Weird internet issue

Good evening brethren,

I need some more minds on the problem I’m working on in one of buildings. Firewall is online but switch doesn’t show in CNM nor do APs. If I plug directly into firewall I have Internet. I swapped the Ethernet cable between the firewall and switch.

I can ping the firewall from a workstation. APs are getting PoE as Liahona is showing. Connecting gets an IP address but no Internet with a browser.

From a wired workstation I can ping IPv4 addresses across the Internet but DNS won’t resolve and times out.

I swapped in a different non-Meraki PoE switch with no different behavior.

It seems like it has to be a switch issue but it’s acting a little like a firewall issue too since DNS isn’t resolving.

It’s late and my brain is fried so I’ll have to come back.

Any suggestions?


Dave

Have you tried "Add devices" to add the switch?

Is the connection from firewall to switch connected to port 9 or 10 of the switch? I'm not sure if the other ports are supported for upstream connections.

Good question! It’s connected to the SFP in port 9. I have actually used port 8 for uplink when I had an SFP failure in another building. It works as long as you set the port as an uplink. That’s not the case here though. It was all working fine until it wasn’t.

Dave

I didn’t try re-adding the switch. That’s a good suggestion.

Dave

superdave98 wrote: Thu Sep 19, 2024 7:02 am It’s connected to the SFP in port 9.

Make sure that cable comes from the firewall port 1. If it still does not work, I would call the Global Services Department and ask them to make sure the firewall is configured properly. When a switch is installed, they deactivate ports 2, 3, and 4.

Something may have happened to firewall port 1. The GSD can figure out if that port is still working.

Thanks for that response. The switch is definitely connected to port 1 on the firewall. If I take that cable out of the switch and plug it into my laptop, I get internet access, which is what makes this whole thing so confusing.

I emailed GSD yesterday, but I haven't heard back yet, so I'll call them today.

Dave

I talked with GSD. It sounds like they're having issues with a third-party DNS filtering provider. They want me to run some commands on a machine in the building to confirm, but it sounds like this is likely the problem I'm having.

I work in IT where I supervise technical support staff. They often complain that they don't need to call tech support because they won't tell them anything they didn't already try. My experience is that's true 90% of the time, but there is that 10% of the time where you'll never figure out the problem without talking to tech support. Because like in this case, they know something specific that you can't know without talking to them.

Dave

Double check that DoT and DoH are not enabled on your workstation and if are using a Mac that its not trying to use Private Relay with your iCloud account. Meetinghouse DNS does not play at all with any of these 3 services. DIG and NSLOOKUP are your friends.

Brad

As a Mac user I connect to Liahona wifi at least twice a week and it's very annoying.

The church network should work with private relay. If not almost all Mac users are going to have to turn off Private relay every time they try to use Liahona Wifi.

I don't think this is an acceptable state. Can I submit this as a bug or issue somewhere.

The church wants to block access to inappropriate sites. But private relay prevents that.

Church's network, church's rules.