University clients associate, pass authentication, and receive an address in the correct subnet. They cannot ping the gateway. Name resolution is not the complaint, because nothing on the subnet answers. What is the next check?
Select an answer to reveal the explanation.
Short Explanation
They joined, they were authenticated, and they were handed an address on the right subnet. The next hop is silent. Your next check is whether the gateway for that VLAN is actually there, since the passphrase already finished.
Full Explanation
A client that has an address in the correct subnet and cannot ping its gateway is past association, authentication, and DHCP. The address points at a gateway that should answer on that VLAN, on the controller uplink for a centrally switched WLAN or on the local switch for a locally switched one. If nothing on the subnet answers, the next check is whether that gateway interface exists, is up, and is the address DHCP handed out. The passphrase or the 802.1X exchange has already succeeded. A failed ping does not mean authentication is still running. Beacons advertise the wireless BSS. They do not carry the gateway address, and the clients already associated, so the beacon interval is not why the gateway is silent. Antenna gain changes coverage. A client that completed DHCP is not failing because the signal is too strong, and a strong signal does not remove a gateway. Exam caveat: the gateway in the DHCP offer has to be the real interface on that VLAN. An offer that names an address nobody owns looks exactly like this. Operational check: from the VLAN, ping the gateway address the client learned, and confirm the switch or controller interface for that VLAN is up.