Guests reach the internet before they authenticate. The pre-authentication filter allows DHCP, DNS, the portal, and general internet access. What is the filter allowing that it should not?
Select an answer to reveal the explanation.
Short Explanation
The guests are on the internet and they have not signed in. Your filter is allowing the world, not just the portal and the plumbing it needs. Take the general internet access back out.
Full Explanation
Before authentication, a guest needs DHCP, DNS, and the portal, and nothing else. This filter also allows general internet access, which is why guests are online before they sign in. DHCP should not be blocked. Without it they never get an address. DNS should not be blocked. Without it they cannot resolve the portal. The portal itself has to be reachable or they cannot sign in. The pre-authentication filter allows the internet, not only DHCP, DNS, and the portal. Guests are online before they authenticate. Check one live client after the change and leave the rest of the floor alone until that client matches the result you expected. Confirm the symptom on the next attempt before changing anything else. Confirm the symptom on the next attempt before changing anything else. Exam caveat: a filter that permits a wide address range because the portal has many addresses can accidentally permit the internet. Permit the portal addresses you actually use. Operational check: join a guest, and before signing in confirm the internet fails and the portal still loads.