Bridged wireless - iPhone says WiFi does not appear to be connected to the internet

[TinOmen]

I have a bridged SSID with a tagged vlan.  DHCP is configured on the Meraki and it's handing out addresses with a local DNS server that's a Windows DC.  DHCP is configured with option 15 and the text lists our domain name.

Domain joined windows devices don't seem to have any problems.  But iPhones will notify users that the WiFi does not appear to be connected to the internet and asks them if they'd like to keep trying or switch to cellular.  When I select keep trying, I am getting internet on the iPhone.  Apps load, sites, streams, etc.  

I keep thinking maybe it's something with the DNS server, but I have network app on my phone and I can query the server for all kinds of domains no issue.  If I switch to an SSID that uses Meraki NAT, no issue.  I don't mind Meraki NAT but this particular SSID has a lot of roaming clients and Meraki's documentation states to use the bridged mode for that to work best.

Anyone run into this issue before?

[alemabrahao]

Have you already done a test with configuring an external DNS? Just to confirm if it could be something DNS related (which I find difficult).

What type of authentication are you using?

[TinOmen]

I'm using WPA2/3 transition mode shared passphrase on the SSID.  
On my phone I manually set the DNS server to google servers and didn't resolve the issue.

I had traffic shaping enabled on it.  Just tried turning it off.  We'll see if that makes a difference.  The only firewall rules I have on it are Allow to the LAN and blocking "P2P file sharing" and "Gaming".  I may try turning those off if the traffic shaping doesn't fix it.  Perhaps Meraki has a URL blocked in Gaming that would affect iOS from knowing it has internet connection?

[GreenMan]

My guess is there's an Internet test that the iOS device is doing that is failing, either cos your DNS can't resolve it (as per @alemabrahao 's suggestion) or maybe there's some traffic being blocked by a firewall upstream?  Run a packet capture to see what's being generated & not correctly responded to..?

[TinOmen]

It's definitely not being blocked up stream on my firewall.  I feel the other SSID that's using Meraki NAT and works rules that out as well.

I do feel you're on to something with the iOS internet test.  I turned off traffic shaping.  I also have a L7 rule to block gaming.  I may remove that as well to rule that out.

[TinOmen · Accepted solution]

After some investigation on this issue, turns out the SSID's using the Meraki DHCP are essentially NATd out via the Management VLAN which has no inspection on our firewall which explains, in part, why Apple web based traffic was flowing fine through these SSIDs and the others were being inspected and subject to geoblocking.  Resolution lied with adding an application policy for apple URLs on the firewall.