E-MSM720 and Open Authentication

[Wk909]

Looking for help on what I thought would be a simple achievement.

I want to provide a single open SSID with all traffic being tunnelled back to the controller and out of a VLAN interface, whilst providing DHCP and DNS to the client.

I've created the network profile and given it an IP, associated it to a physical port and connected to the upstream switch. Connectivity appears to work as expected. I've then created the appropriate VSC with authentication and access control checked, but no authentication methods selected. I had to check both authentication and access control to be able to create a DHCP pool and select to always tunnel client traffic.

DNS resolution appears to work via the DNS interception option, and I can get an address in the correct subnet, but I cannot browse the web. I've used a default router in my DHCP scope of the upstream switch interface, which I can PING over the wireless and DNS is the IP interface I created on the MSM.

Anyone got any ideas, any help would be appreciated,