Multiple Network Segments

[jazzman222]

Hello,

I am configuring a scenario with multiple network segments. Everything appears to be fine -- I can get DHCP from the Firstspot over two router hops. I can ping the FirstSpot server BUT.... I can not access the login page -- it never comes up. When pinging anything beyond the FirstSpot box I do get a destination host unreachable -- which I would expect due to not being able to login and authenticate from FirstSpot. I am using IP based session handling. Can someone provide some insight as to where my config may be wrong....

Thanks

[alan]

Try to initiate the traffic from the local segment first as a test (i.e. no router between client and FirstSpot).

Also, please refer to http://www.patronsoft.com/forum/viewtopic.php?t=1191 and http://www.patronsoft.com/forum/viewtopic.php?t=1086 for some troubleshooting tips.
_________________
~ Patronsoft Limited ~

[jazzman222]

Thanks for the update. I can access FirstSpot on the local segment - that works fine. The two articles provided in the last post do not seem to point to this problem. To note, I can ping the FirstSpot server from the remote segment and get DHCP just fine. I can not get the login page nor can I load any pages on the exception list especially patronsoft.com. I am thinking there might be a routing problem but can't figure out why that would be since I can ping the firstspot server but nothing past that.

When I am in the cisco router that is connected to the FirstSpot server I can NOT ping the public IP of the FirstSpot server which leads me to believe that there might be a routing issue but I can't put my finger on it. I thought that Routing and Remote Access was not started on the box but it is.

I can provide a diagram of what the network layout looks like and remote access to the box if needed. This looks like the ideal product for us and we are ready to purchase once we get this config resolved.

Thanks again.

[alan]

It sounds a bit more like DNS problem than routing problem.

Can you run the following commands (in both FirstSpot and remote segment client PC):

ipconfig/all
nslookup
set d2
apple.com

and post the result here?
_________________
~ Patronsoft Limited ~

[jazzman222]

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

Host Name . . . . . . . . . . . . : hotspot
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Broadcast
IP Routing Enabled. . . . . . . . : Yes
WINS Proxy Enabled. . . . . . . . : Yes

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connect
ion
Physical Address. . . . . . . . . : 00-0D-56-CA-34-6A
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 64.139.98.247
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 64.139.98.1
DNS Servers . . . . . . . . . . . : 64.139.97.3
206.253.194.65

Ethernet adapter Local Area Connection 2:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8139 Family PCI Fast Ethe
rnet NIC
Physical Address. . . . . . . . . : 00-11-95-26-22-3F
Dhcp Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : 10.0.0.5
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 10.0.0.5

C:\Documents and Settings\Administrator>

C:\Documents and Settings\Administr
Default Server: firstspot.org
Address: 10.0.0.5

> set d2
> apple.com
Server: firstspot.org
Address: 10.0.0.5

------------
SendRequest(), len 27
HEADER:
opcode = QUERY, id = 2, rco
header flags: query, want
questions = 1, answers = 0

QUESTIONS:
apple.com, type = A, class

------------
------------
Got answer (475 bytes):
HEADER:
opcode = QUERY, id = 2, rco
header flags: response, wa
questions = 1, answers = 1

QUESTIONS:
apple.com, type = A, class
ANSWERS:
-> apple.com
type = A, class = IN, dlen
internet address = 17.254.3
ttl = 380 (6 mins 20 secs)
AUTHORITY RECORDS:
-> com
type = NS, class = IN, dlen
nameserver = c.gtld-servers
ttl = 75888 (21 hours 4 min
-> com
type = NS, class = IN, dlen
nameserver = d.gtld-servers
ttl = 75888 (21 hours 4 min
-> com
type = NS, class = IN, dlen
nameserver = e.gtld-servers
ttl = 75888 (21 hours 4 min
-> com
type = NS, class = IN, dlen
nameserver = f.gtld-servers
ttl = 75888 (21 hours 4 min
-> com
type = NS, class = IN, dlen
nameserver = g.gtld-servers
ttl = 75888 (21 hours 4 min
-> com
type = NS, class = IN, dlen
nameserver = h.gtld-servers
ttl = 75888 (21 hours 4 min
-> com
type = NS, class = IN, dlen
nameserver = i.gtld-servers
ttl = 75888 (21 hours 4 min
-> com
type = NS, class = IN, dlen
nameserver = j.gtld-servers
ttl = 75888 (21 hours 4 min
-> com
type = NS, class = IN, dlen
nameserver = k.gtld-servers
ttl = 75888 (21 hours 4 min
-> com
type = NS, class = IN, dlen
nameserver = l.gtld-servers
ttl = 75888 (21 hours 4 min
-> com
type = NS, class = IN, dlen
nameserver = m.gtld-servers
ttl = 75888 (21 hours 4 min
-> com
type = NS, class = IN, dlen
nameserver = a.gtld-servers
ttl = 75888 (21 hours 4 min
-> com
type = NS, class = IN, dlen
nameserver = b.gtld-servers
ttl = 75888 (21 hours 4 min
ADDITIONAL RECORDS:
-> a.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.5.6.
ttl = 52142 (14 hours 29 mi
-> b.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.33.1
ttl = 52142 (14 hours 29 mi
-> c.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.26.9
ttl = 52142 (14 hours 29 mi
-> d.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.31.8
ttl = 52142 (14 hours 29 mi
-> e.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.12.9
ttl = 52142 (14 hours 29 mi
-> f.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.35.5
ttl = 52142 (14 hours 29 mi
-> g.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.42.9
ttl = 52142 (14 hours 29 mi
-> h.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.54.1
ttl = 52142 (14 hours 29 mi
-> i.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.43.1
ttl = 52142 (14 hours 29 mi
-> j.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.48.7
ttl = 52142 (14 hours 29 mi
-> k.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.52.1
ttl = 52142 (14 hours 29 mi
-> l.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.41.1
ttl = 47155 (13 hours 5 min
-> m.gtld-servers.net
type = A, class = IN, dlen
internet address = 192.55.8
ttl = 47155 (13 hours 5 min

------------
Non-authoritative answer:
Name: apple.com
Address: 17.254.3.183

>

[jazzman222]

Ethernet adapter Wireless Network Connection:

Connection-specific DNS Suffix . : firstspot.org
Description . . . . . . . . . . . : Belkin 802.11g Network Adapter
Physical Address. . . . . . . . . : 00-11-50-20-03-0A
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.20.240
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.20.1
DHCP Server . . . . . . . . . . . : 10.0.0.5
DNS Servers . . . . . . . . . . . : 64.139.97.3
206.253.194.65
Lease Obtained. . . . . . . . . . : Tuesday, June 26, 2007 11:01:16 AM
Lease Expires . . . . . . . . . . : Thursday, June 28, 2007 11:01:16 AM

C:\Documents and Settings\DJW>


C:\Documents and Settings\DJW>nslookup
DNS request timed out.
timeout was 2 seconds.
*** Can't find server name for address 64.139.97.3: Timed out
DNS request timed out.
timeout was 2 seconds.
*** Can't find server name for address 206.253.194.65: Timed out
*** Default servers are not available
Default Server: UnKnown
Address: 64.139.97.3

> set d2
> apple.com
Server: UnKnown
Address: 64.139.97.3

------------
SendRequest(), len 41
HEADER:
opcode = QUERY, id = 3, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
apple.com.firstspot.org, type = A, class = IN

------------
DNS request timed out.
timeout was 2 seconds.
timeout (2 secs)
SendRequest failed
------------
SendRequest(), len 27
HEADER:
opcode = QUERY, id = 4, rcode = NOERROR
header flags: query, want recursion
questions = 1, answers = 0, authority records = 0, additional = 0

QUESTIONS:
apple.com, type = A, class = IN

------------
DNS request timed out.
timeout was 2 seconds.
timeout (2 secs)
SendRequest failed
*** Request to UnKnown timed-out
>

[alan]

Definitely DNS problem in the client PC. Please post your config.ini and AllowedHostsIps.txt files so that we can inspect your settings.
_________________
~ Patronsoft Limited ~

[jazzman222]

;
; Description : FirstSpot setting ini file
;
; Filename : config.ini
;

; Note: use a backslash to separate directories and files, those lines starting with
; a semi-colon are considered as comments.
;
; Warning : please don't change this file without supervision of a PatronSoft Engineer
; It is highly recommended that you change the FirstSpot setting in the Web-based Configuration Manager

[version]
version=Trial
versionDesc=4.0.13

[MNS]
; number of return paths
num_return_path=2
return_path0=192.168.20.1 255.255.255.0 10.0.0.1
return_path1=10.0.0.1 255.255.255.0 10.0.0.1

[DHCP]
leasetime=2880
num_ignored_addr=0
ignore_addr0=

[Port Filter]
flt_num=
flt_0=

[QOS]
dl=
ul=
qos_num=
qos_0=

[Client Pass]
num_mac_addr=0
mac_0=
num_ip_addr=0
ip_0=

[proxyARP]
ip_num=
ip_addr0=

;
; Redirect Login Page php file
;
[loginPhp]
Login_enable0=0
Login_php_Num0=
Login_enable1=0
Login_php_Num1=

;
; Gateway Settings
;
[gateway]
;Print Log Table
Datasource_Printlog=printlog

;Shared Secret Table Name
Datasource_Shared_Secret_Tablename=fssecret

;maximum timelimit per session in minutes (global), 0 = never
sessionlimit =

;URL tracking, default off
Trace_URL=0

;URL tracking interval, do not log the same url for particular user in x mins
Trace_URL_Interval=30

;URL tracking table
Datasource_URL_Log_Tablename=fsurl

;extra-information field table name
Datasource_extra_field_table = aexlog

;demo_mode=on, off (default)
;
;This demo_mode parameter is for FirstSpot channel partners demonstration purpose
;If demo_mode=on, FirstSpot DNS Server and Web Server will perform a catch-all on all
;requests. After the user login, the client will always see the "firstspotdemo" page.
demo_mode=off

;redirect user to cart.php when login fails
redirect_cart=1

;Client Isolation, NetBIOS over TCP/IP, Default is Disabled
netbios=1

;Scenario 2 (Distributed Network Topology)
scenario2=0

; Post-Startup Batch File Path Name
batch_filePath =

; lan's subnet mask (please change this through Configuration Manager only)
;
subnet_mask =255.255.255.0

; domain name server IP address
;
DNS =64.139.97.3

; domain name server IP address
;
preferred_DNS =64.139.97.3

; domain name server IP address
;
alternate_DNS =206.253.194.65

; username
;
user =firstspot

; password
;
pass =a03af780c0f2959f26512a2cc8c2efb6

;Number of maximum administrator account
max_admin_account = 10

;Administrator username
admin_username0 =
admin_username1 =
admin_username2 =
admin_username3 =
admin_username4 =
admin_username5 =
admin_username6 =
admin_username7 =
admin_username8 =
admin_username9 =

;Administrator password
admin_password0 =
admin_password1 =
admin_password2 =
admin_password3 =
admin_password4 =
admin_password5 =
admin_password6 =
admin_password7 =
admin_password8 =
admin_password9 =

;Administrator parameter
admin_parameter0 =
admin_parameter1 =
admin_parameter2 =
admin_parameter3 =
admin_parameter4 =
admin_parameter5 =
admin_parameter6 =
admin_parameter7 =
admin_parameter8 =
admin_parameter9 =

; network interface card connected to Internet (after modify this, need to restart FirstSpot)
;
publicNIC=Local Area Connection
; network interface card connected Hotspots or visitor-based networks (after modify this, need to bind the FirstHop driver
; to this new card and unbind the FirstHop driver from ALL other cards, then reboot Windows)
;
privateNIC=Local Area Connection 2
; data source for user login
;
Datasource =C:\Program Files\FirstSpot\datasource\firstspot.dsn

; datasource table for user login
;
Datasource_Tablename = fsusr

; datasource table for user login
Datasource_Plans_Tablename = fsplans

; enable session logging into the datasource log table
session_log =ON

; datasource table for user session logging
;
Datasource_Log_Tablename = fsusrlog

; datasource table for PayPal
;
Datasource_PayPal_Table=ppal

; port used by Gateway Service
;
port =5786

; port used by Authentication Server
;
auth_port =5788

; port used by ssl site
;
ssl_port =5789

; Greeting message displayed in login page
;
greeting_msg =Welcome to our Hotspot!

; Enable to show InfoBox
;
show_infobox =ON

; Login page picture (filename)
;
loginpage_pic_name=autumn.jpg

; authentication server IP address (please change this through Configuration Manager only)
; Note: different from gateway_IP when it is not installed in gateway (not officially supported in this version)
;
auth_IP =10.0.0.5

; login page filename which dispatcher will call
;
loginpage =login_select.php

; login form filename which login_select.php will call
;
loginform =login_form.php

; anonymous login form filename which login_select.php will call
;
a_loginform =alogin_form.php

; authentication form filename which authentication.php will call
;
reauthenticationform =reauth_form.php

; anonymous authentication form filename which authentication.php will call
;
a_reauthenticationform =alogout_form.php

; idle time (minutes) allowed for authenticated users
;
idle_timeout =10

; private network (please change this through Configuration Manager only)
;
private_IP =10.0.0.0

; gateway IP address (please change this through Configuration Manager only)
;
gateway_IP =10.0.0.5

; allow access to config manager from private network?
;
access_from_private =off

; allow access to config manager from public network?
;
access_from_public =off

; license file path
;
licensepath =C:\Program Files\FirstSpot\

; session handling mode, 0 for MAC-based, 1 for IP-based
session_handling =1

; path for dhcp config
dhcppath =C:\Program Files\FirstSpot\dhcp\dhcpservice.ini

; dhcp mode, 0 = auto, 1 = static, 2 = disabled
dhcpmode =0

; for static dhcp only, path of the Ip MAC mapping list
static_dhcp_path =C:\Program Files\FirstSpot\StaticDHCP.txt

; anonymous login
anonymous_login =OFF

; secret enable
secret_enable=off

; secret code
secret_code=0aed120c6f7090a5b26a4c93df382b21

; anonymous login user table name
Datasource_Anonymous_Tablename =fsa

; anonymous login log table name
Datasource_Anonymous_Log_Tablename =fsalog

; password offloading mode
pwd_offload = off

; password encryption directory path
encrypt_path =C:\Program Files\FirstSpot\dispatcher\encrypt_pwd.exe

; initial air time in minutes for self signup users
self_sign_up_credit=0

; self signup filtering
self_signup_filter=1

;allow self-signup without an ip/mac, 0=yes, 1=no
self_signup_no_mac=1

; null=no filter, 0 = signup once, >0 after x mins
self_signup_period=

;use 3 party ssl cert 0=yes 1=no
ssl_cert=1

;secure socket layer for authentication
;443 for enabled SSL, auth_port=ssl_auth_port for disabled ssl
ssl_auth_port=5788

;rewrite engine for http to https redirection
rewrite_engine=off

;NAT
nat=0

;maximum fail attempt allowed
max_attempt=

;If user accesses http://10.20.7.1:5788 directly, redirect the request to any non-existing ip,
;so that driver can capture the request properly.
;DO NOT put any unresolvable domain name here
redirect_address=http://64.139.98.247/logged_in.html

;port to handle https request in apache when user is not authenticate
redirect_port=5790

restricted_redirect=0

; Allowed Hosts Settings
;
[allowed hosts]
; allowed hosts keywords file path
;
hosts_keywords_path =C:\Program Files\FirstSpot\AllowedHostsKeywords.txt

; allowed hosts IPs file path
;
hosts_ips_path =C:\Program Files\FirstSpot\AllowedHostsIps.txt


; Bandwidth Throttle Settings
[bw_throttle]
; Bandwidth Throttle Mode
bt_mode =0

; Overall Upload Limit (at least 20KB/s recommended)
bt_ul_limit =0

; Overall Download Limit (at least 20KB/s recommended)
bt_dl_limit =0

; low, medium and high definition
bt_low=100
bt_medium=50
bt_high=20
bt_drop_period=2

[bwreset]
bwresetmethod=
bwresetperiod=
lastresetbw=

[creditcard]
payment_method=ppal

[paypal]
; Business id
;
ppal_business=your_business_id@your_email.com

; URL for successful transactions
;
ppal_return=http://10.20.7.1:5788/cart.php

; URL for cancelled transactions
;
ppal_cancel_return=http://10.20.7.1:5788/cart.php

; trust "Pending"=="Complete"?
;
ppal_pending_release=no

; the settlement currency
;
ppal_base_currency=USD

; URL for notify
;
ppal_notify_url=http://fixed_ip:5789

; Starting number for invoice
;
ppal_invoice_start=1

[worldpay]
; Installation id
;
wpay_instID=your_installation_ID

; the settlement currency
;
wpay_base_currency=USD

; URL for notify
;
wpay_notify_url=http://fixed_ip:5789

; Test Mode
; 100 : test mode - always successful validation
; 101 : test mode - always failed validation
; 0 : test mode - live mode, not testing
;
wpay_testmode=0

[AuthorizeNet]

;login id
aNet_id=

;transaction key
aNet_key=

aNet_hash=

aNet_base_currency=USD

; URL for notify
aNet_notify_url=http://fixed_ip

; Test Mode
; 0 : test mode - live mode, not testing
; 1 : test mode - testing only
aNet_testmode=0

[PrinterOn]

PrintSupport=0
SiteURL=
SiteUID=
SiteAuth=
; show siteURL
show_URL_login=1
show_URL_infobox=1

[lang]
; default language file
default_lang_file=lang.php
default_lang_file_attributes=English;en,en-us;iso-8859-1
; number of other language files
lang_fileNumber=0
; other luguage files
lang_file1=
lang_file1_attributes=
lang_file2=
lang_file2_attributes=
lang_file3=
lang_file3_attributes=
lang_file4=
lang_file4_attributes=
lang_file5=
lang_file5_attributes=
; show character encoding
; 0 : hide
; 1 : show
show_charset=1

lang_pack_file=custom_lang.php
cmlang_pack_file=custom_cmlang.php
last_logout=logout
this_logout=logout
last_info=infobox
this_info=infobox
last_cart=cart
this_cart=cart
key_0=
url_0=
signup01=off
signup02=off
signup03=off
signup04=off
signup05=off
signup06=off
signup07=off
signup08=off
signup09=off
signup10=off
ReqSignUp01=off
ReqSignUp02=off
ReqSignUp03=off
ReqSignUp04=off
ReqSignUp05=off
ReqSignUp06=off
ReqSignUp07=off
ReqSignUp08=off
ReqSignUp09=off
ReqSignUp10=off

; Setting of cart description
[cart]
max_slot_open=0

[radius]
use_radius=false
ServerIP=10.20.7.1
AuthPort=1812
AccPort=1813
Secret=secret
FSVendorID=2004
Datasource=C:\Program Files\FirstSpot\datasource\radius.dsn
Datasource_Tablename=fsRadius
Acc_Start=true
Acc_Stop=true
;Acc_FSLogin=true
;Acc_FSLogout=true
;Acc_FSWriteLog=true

[radiusAuthentication]
NAS_IDENTIFIER=FirstSpot
;NAS_IP_ADDRESS=the private nic ip, this can be edited.
;CALLING_STATION_ID=client nic mac or ip, depends on the Firstspot setting, this can not be edited.
;CALLED_STATION_ID=firstspot private nic mac, this can not be edited.

[radiusCustomAttribute]
;Vendor spec type for Firstspot
;fixed value can not be changed.
;
;FS_AUTH_TIMELEFT=1
;FS_AUTH_ACCUMBW=2
;FS_AUTH_BWQUOTA=3
;FS_AUTH_BWCOUNT=4
;FS_AUTH_ULLIMIT=5
;FS_AUTH_DLLIMIT=6
;FS_AUTH_LOGINTIME=7
;FS_AUTH_LOGOUTTIME=8
;FS_AUTH_TIMEDIFF=9
;FS_AUTH_BWUSAGE=10

;Account Status Type Attributes, can be changed.
;
;default ACCT_STATUS_FSLOGIN=217
;default ACCT_STATUS_FSLOGOUT=218
;default ACCT_STATUS_FSWRITELOG=219

[prepaidCard]
random_usr_prefix=usr_
random_usr_suffix_salt=abcdefghjkmnpqrstuvwxyzABCDEFGHJKMNPQRSTUVWXYZ123456789
random_usr_suffix_length=5
pwd_salt=abcdefghjkmnpqrstuvwxyzABCDEFGHJKMNPQRSTUVWXYZ123456789
pwd_length=7

[ACL]
num_acl=0

[fssmtp]
smtp =false
IspSmtpDomain=

[misc]
show_cart=yes
enable_chgpwd=1
block_icmp=off
block_udp=on
_debug=1
pkt_period=20
oem=C:\WINDOWS\INF\oem25.inf
PublicAdapterIP=64.139.98.247
PublicAdapterIpMask=255.255.255.0
PublicAdapterGateway=64.139.98.1
PrivateMAC=00119526223f
[DataTransfer]
bwcount_dl=0
bwcount_ul=0

[jazzman222]

;
; Filename : AllowedHostsIps.txt
;
; Description : Allowed Hosts IPs listing file
;
; Copyright (c) 2002-2005, PatronSoft Limited
;

;
; Exception Free Website - Internet Hosts IPs Allowed
;
; Note: specify the "IP Addresses" of the each allowed host, you may
; need to update frequently for those hosts with dynamic IPs.
;
; Please review the manual first before changing this file directly.
; OR you can change this setting in the Web-based Configuration Manager

;**********Official Free Sites. Please DO NOT change or remove**********

; PatronSoft Limited
209.50.241.72

;**********End Official Free Sites**********

64.139.97.3
206.253.194.65

[alan]

In the Configuration Manager UI, please:

1) remove the Multiple Network Segments entry:

10.0.0.1 255.255.255.0 10.0.0.1

This is not necessary and may cause confusion to FirstSpot. Again, refer to chapter 4 of firstspot_guide.pdf for an example.

2) set the "DNS server IP" (under Dispatcher) back to 0.0.0.0

Make sure you restart FirstSpot after making the above changes. If you still have problem, please post the ipconfig and nslookup output (issue from the client side) again.
_________________
~ Patronsoft Limited ~

[jazzman222]

I have removed those settings and it will be at least 16 hours or so until I can test as I am not in the office right now. Interestingly enough I added those settings to make the local segment connection work when you asked me to test that earlier in our thread.... I will let you know what I find.

Thanks

[alan]

If you need to add "10.0.0.1 255.255.255.0 10.0.0.1" to make the local segment work, something wrong in the network setup and you shouldn't count on it.

The key to your problem is that the client seems to be unable to contact the remote DNS (64.139.97.3 or 206.253.194.65) that you configure. Just do what I recommend first, if it still doesn't work you might want to change the setup so that the client will use FirstSpot DNS instead.
_________________
~ Patronsoft Limited ~

[jazzman222]

Well, I thought since I am in test only let me start again so I uninstalled and reinstalled and reconfigured everything -- BUT STILL HAD THE SAME PROBLEM.... What it turned out to be was a routing issue. I am using Cisco routers and the routers could talk to each other and I could ping from the client to the FirstSpot box but not beyond so, I added the following route statement to see what would happen:

ip route 0.0.0.0 0.0.0.0 10.20.7.1

Which states send anything it doesn't know about to the FirstSport box and Viola! it works. The route statements are not something you normally need with regular routers but our environment will have cisco routers at some of the hops. Thanks for your help and a purchase is coming your way!

Dan