Wireless Access

Hello,

 

We have an issue with our guest SSID on Aruba Instant AP 205.

 

The guest wifi is configured to use both MAC authetification and username/password.

 

The problem is that guests who authenticate with username/password get disconnected after random time (and not the one setted up into the configuration) and have to reconnect.

After some tests we noticed that there is no disconnection when we disable the MAC authentification (but we need it...). We believe that the AP check the MAC adress for time to time and disconnect the user if the MAC is not authorized...

 

Any idea on how to resolve this issue?

 

Thank you,

 

Cyril

You should look in the access tracker to see if there is any activity on that client...

Thank you for your reply.

 

Is the access tracker available on the AP205 ? We are not using a physical controller or clearpass.

 

Cyril

 

 

I apologize.

 

Is this a controller-based deployment?  Are you turning on the mac filter by enabling mac authentication?  What is your mac authentication configuration?

We have configured a virtual controller. 

Yes we have enabled the MAC authenthication on the security tab of the guest wifi configuration setup (see attached picture). 

 

Let me know if you need more information.

 

Thank you for your help,

 

Cyril

That is a picture of the transmit power...

Sorry wrong file... Here is the correct picture.

According to that picture, guests are forced to reauthenticate after 24 hours.  That should not be triggered unlesss your guests are connected for 24 hours straight.  I would set the reauthentication interval to 0 and see if it continues to happen.

I have changed the reauthentication interval to 0 and the issue still happen.

 

Thanks,

 

Cyril

Mac authentication should not allow a user to connect if their mac address is not in the list.  It should not disconnect them after that.

 

When you say disconnect, what you do mean?  What happens?  Does the user lose their ip address?

 

What kind of authentication are you using besides mac authentication on this SSID?

We are using this SSID for two ways of authetication :

- MAC authentication : MAC adresses are registered into the user list and the clients can access the WiFi without having to login on the captive portal. This one works great.

- User authentication : We create login ID/password for guest to be able to access our guest wifi via the captive portal. Here is where we have a problem. The users can connect and access the Internet but they are randomly, and very often, disconnected, that mean that the captive portal ask them to connect again with their ID/password.

 

For testing purpose, we have created an other guest wifi with the same parameters except the MAC authentication, and the users with ID/password are not disconected after authenticate on the captive portal.

 

Cyril

 

Can we see your entire configuration for that SSID?

 

wlan access-rule WIFI-EXT
index 3
rule 10.0.0.0 255.0.0.0 match any any any deny
rule 172.16.0.0 255.240.0.0 match any any any deny
rule 192.168.0.0 255.255.0.0 match any any any deny
rule any any match any any any permit

 

wlan ssid-profile WIFI-EXT
enable
index 1
type guest
essid LSG-WIFI-EXT
opmode opensystem
max-authentication-failures 0
vlan guest
auth-server InternalServer
rf-band all
captive-portal internal
mac-authentication
mac-authentication-delimiter :
dtim-period 1
inactivity-timeout 3600
broadcast-filter all
g-min-tx-rate 11
a-min-tx-rate 18
dmo-channel-utilization-threshold 90
local-probe-req-thresh 0
max-clients-threshold 64

You are missing a rule on top that allows DHCP from any to any.

wlan access-rule WIFI-EXT
 index 3
 rule any any match udp 67 68 permit
 rule 10.0.0.0 255.0.0.0 match any any any deny
 rule 172.16.0.0 255.240.0.0 match any any any deny
 rule 192.168.0.0 255.255.0.0 match any any any deny
 rule any any match any any any permit

Still the same :(.

We are still affected by the problem, any new idea on how to resolve it?

 

Thanks,

 

Cyril

What subnet are your guests on?

The subnet is 10.65.223.0/24

What server is providing DHCP for this network? (IP address)
Have you considered not blocking anything for 24 hours and seeing if you still have the issue?

The DHCP is managed by the virtual controller (10.65.2.244).

Yes we have tried without any rules and it does not resolve the issue. The only thing that we found to resolve it is to disable the MAC authentification.

 

Cyril

 

Hi,

 

Any new idea over here? We still face the problem.

 

Thanks,

 

Cyril

Your a-min-tx-rate is pretty high at 18.  Your clients would have to be very close to use a number that high.  I would start with the default back at 6.

Thanks for your help, I tried with 6 but it does not fix the problem.