Wireless Access

Hi Guys,

Until recently I've never had any problems with the Always SSID, but tonight a remote site lost WAN connectivity causing the 3 AP68 RAPs to drop off the controller. For a while the client devices seemed to function OK, but after a while - I'm not sure how long at the moment, i think the APs must have stopped broadcasting because the clients couldn't connect and there was no evidence of them in the routers ARP table, although the APs were pingable so they were physically connected fine.

I'm just wondering if there's a logical explanation for this, could any other setting cause this to happen such as LMS Hold-down period or IPSEC retries or something like that?

When the WAN connection came back up, the APs reconnected instantly and the client devices were then working, there's nothing useful in the debug log, I'm guessing because that's live and not historic? I've captured a TS Log but can't see anything obvous in that.

*edit*

forgot to mention I'm using mixed WPA-TKIP and WPA2-AES.

Also just tried recreating the problem, the client maintains association after the connection to the controller is lost, but if I reboot the AP and it's unable to route to the controller, the SSID is broadcast but it seems to fail to authenticate.

I'm in the process of testing with just WPA-TKIP now ......... which also seems to fail to authenticate after reboot while the RAP is offline.

I'm certain I have tested this in the past without any problems!

The SSID is definately set to Always so I'm not sure what or why this would have happened!

*Edit*

Oh and my hardware is M3 / AP68/93 as RAP, 5.0.4.3

I think I've narrowed it down to being a problem with authentication as I thought, having a VAP with no authentication works fine in the same scenario. Having just WPA-TKIP selected caused the problem as well as WPA-TKIP + WPA2-AES.

An "Always SSID" that requires authentication will stay up, but will not authenticate any users further when it loses connection to the controller.

Oh....

Even if it's not using the controller for authentication? That doesn't seem like a good feature?

Please search the ArubaOS 6.1 user guide for "Remote AP Modes of Operation and Behavior" for full details on this feature.

Hmm

Looking at that table, which I do remember looking at before, it seems to me that an Always - Bridge Mode ESSID should work with a PSK. This is the scenario I think I have but it doesn't work for me?

always ESSID is always up
when the AP is up
regardless if the
controller is
reachable.
Supports PSK ESSID
only.
SSID configuration
stored in flash on AP.
Provides an SSID that
is always available

Am I just misunderstanding this description?

To clarify, after reading that, I would think that an Always SSID would work and authenticate as long as it was using a PSK mode when the controller was unreachable.

My VAP is configured as Always, my SSID is configured as WPA-PSK TKIP.

I need Fat AP functionality when there's no route to the controller!

It should work in that mode.  Please open a case with support.  I was confused when you said "authentication".  If it is a PSK, it is configured as a remote AP and the forwarding mode is bridged, it should work like it says.

Thanks and sorry - people not being accurate with terminology must be a real pain :)

I was sure I had tested this some time ago, possibly 12-18 months ago and I was convinced I had covered all the scenarios and it was working, but I have since upgraded to 5.0.4.3 so I guess it could be related to the software change.