Wireless Access

Hi folks,

After reading through the RF recomended settings by aruba yesterday I had enabled profiles on our 4030 controller for 802.11r.  We are already using 802.11k on our campus site and on our sites that we have RAPs. 

The RAPs are provisioned to a public IP and then our ASA NATs this to the IP of our controller on site.  Our corporate uses 802.11x profile and WPA2 for authentication and guest simply uses WPA-PSK with no issues. 

Upon enabling the 802.11r profile all of our GUEST users on REMOTE sites only lost conneciton and could not reconnect (or at least 95% of them).

All the corporate users on remote sites remained connected with no issues.

All users on site with the campus APS both corporate and guest were unaffected. 

I have no idea what would cause this.  The RAPS operate in split tunnel mode.  Is this not supported for 802.11r?

Where did you see those recommended settings?

http://community.arubanetworks.com/t5/Validated-Reference-Design/RF-and-Roaming-Optimization-for-Aruba-802-11ac-Networks/ta-p/432994

It also says " It is recommended to enable 802.11r on the network. However, It is recommended to test interoperability of most common devices expected in your environment with this feature enabled. Some older 802.11n devices, handheld scanners and printers may have connectivity issues with 802.11r enabled on WLAN. 802.11r supports faster client roaming."

If you have a guest network, and you cannot control what devices come on it, you should not enable 802.11r.

Also, if you have a split-tunneled SSID, it is assumed that SSID is on a single device at a site, you would not need the roaming improvements, so you should not enable 802.11r.

Yeah i know this and we have a current struggle where some employees connect to the guest network which is a constant battle.

However my confusion was more to do with the fact that the coroprate profile worked fine.  It was as if all people on the guest network lost connectivity but only on Remote sites not on campus so i wanted to work out what was the cause.

I found this article about Fast BSS transition not being supported in split tunnel - could this be the isssue?

https://www.arubanetworks.com/techdocs/ArubaOS_63_Web_Help/Content/ArubaFrameStyles/VirtualAPs/Configuring_Fast_BSS_Tra.htm

Correct, not supported on split-tunnel.

Thanks Colin!

What are your thoughts on having 802.11k enabled for users on remote sites?  Do you think this would cause any issues and if so in what area?

It is currently enabled but having no reports of issues at present unless users these are just not being highlighted.  Image of current setting attached.

As long as you have QUIET IE unchecked, you should not have problems (Intel Client issue).

Where did you see those recommended settings?