We did some more tests, and it looks like when a "real" failover happens, the 1:1 NAT is handled correctly. When we do a switch of primary-spare initiated from the Meraki dashboard, the 1:1 NAT stays with the device which becomes inactive and it will not work properly. ... View more

After more than four years, this still seems to be an issue. I don't buy the argument that I should clear the upstream device cache. If there is a failover, that should just happen without anyone intervening in any way. ... View more

  Sure. Let me find my notes. Here they are:   a.) Log in to your Cisco Wireless Controller b.) Go to Controller/Internal DHCP Server/DHCP Scope, click your scope and take a note of your DNS servers. In my case these were 8.8.8.8 and 8.8.4.4. Usually you have only two DNS servers, but it is also possible to set three. c.) Go to Controller > Interfaces and take a note of your virtual address. d.) Go to Security, Access Control Lists, Access Control Lists. e.) Create a new Access Control List by clicking New. Name it Pre-Auth-ACL. f.) Click the name of the newly created ACL. g.) Add the following five rules, while keeping their order. 1. Permit, Source 0.0.0.0/0.0.0.0, Destination: 0.0.0.0/0.0.0.0, Protocol: Any, Source port: Any, Dest port: Any, Direction: outbound. 2. Permit, Source 0.0.0.0/0.0.0.0, Destination: (your virtual address)/0.0.0.0, Protocol: Any, Source port: Any, Dest port: DNS, Direction: inbound. 3. Permit, Source 0.0.0.0/0.0.0.0, Destination: (your primary DNS)/0.0.0.0, Protocol: Any, Source port: Any, Dest port: DNS, Direction: inbound. 4. Permit, Source 0.0.0.0/0.0.0.0, Destination: (your secondary DNS)/0.0.0.0, Protocol: Any, Source port: Any, Dest port: DNS, Direction: inbound. (If you have a third DNS, add it here) 5. Deny, Source 0.0.0.0/0.0.0.0, Destination: 0.0.0.0/0.0.0.0, Protocol: Any, Source port: Any, Dest port: Any, Direction: inbound.   h. Go to WLANS, Select your guest network, Select Security, Layer 3, and set the newly created ACL as Preauthentication ACL for IPv4.   ... View more

Well, I am quite sure we don't want spend some more money this way just to plug this hole. It is possible to set custom DNS per SSID (Content filtering: custom DNS), we tried that, it did not work. ... View more

SLR, can you please elaborate? Where do you set Umbrella and how will that stop tunneling over DNS?   We tried to set Custom DNS in the SSID settings, even that is not working in the pre-auth phase.   ... View more

The issue here is that DNS to any public IP is allowed in the pre-auth phase. It should be allowed only to those servers which are handed out to client by DHCP. Those allowed should be captured and all answers should point to the captive server instead of the original answer. Cisco WLC is also vulnerable but that can be fixed by creating a pre-auth ACL. ... View more