Wireless Access

Hello

I am having difficulties with mobile phones across the campus. Users are telling me that when using the phones (Android or Apple) they does not seems to roam across AP successfully. If users stay in the same location even if they put the phone to sleep mode and then start using it the device will keep the same IP address and work without an issue. However, if the user start walking far to another location I can see in the controller when they switch to another AP but the users are telling me they "lose connection" they have to turn off/on wifi to regain connectivity. Any suggestion on how to approach this? The signal strength is not a problem because even though they see full bars the issue still happen. Also, I see they keep the same IP address too when they change AP so they do have a routable IP address. Anyone?

Thank you,

Nils.

What is your setup, what is your encryption?  What ArubaOS version?  What access points?

Hello

No Encryption or Authentication in the SSID. The Authentication is based on Mac addresses on a Radius Server. The Access Points are: 135, 125, 105, and 70. The Primary Controller is a 3400 and locals are M3 cards.

The version isL ArubaOS 6.1.3.1 (Digitally Signed - Production Build)

Thank you,

Nils

Also when i look at the user in the user-table i see two records. I do not understand if it is a bug in the code. See image attached. The user get an 137 IP but then there is also another record there. Dont know if there is a bug in the code. Please advice

Nils

I was not able to see the image, but i have seen things like that before.  When a user roams and roaming is not successful, they may end up with a self-assigned (169.254.x.x) address and then re-auth.  The re-auth works and they have a valid IP.  The controller will keep both around for a while and eventually age out the self-assigned IP.  You can use the validuser ACL to stop that behavior.  Search thie forum for validuser and you will find lots of info on how that works.

As far as why the clients aren't roaming, can you re-create it?  If so, turn on debugging for a MAC address (logging level debug user-debug xx:xx:xx:xx:xx:xx) and then force it to happen.  Then, check "show log user-debug all" and "show auth-tracebuf" and see if you can find any indication why roaming is not working.

I activate debugging in some users phones i will update this discussion later.

I thought the issue was just Roaming, but i received report that some users were connected to wireless network in the same area without roaming and still get disconnected for a few minutes. The users turn off/on the Wifi and the computer will reconnect fine. By same area I mean they did not even roam from AP to AP and all the AP in the same building terminate in the same controller. The users told me they see full bars and they still see the same IP address. Any thoughts? I was reading this article from Princeton university that they reported iOS devices having wifi problems but I do not want to assume it is just a client device issue. Any suggestions? I checked the logs and the user authenticate fine.

http://www.net.princeton.edu/apple-ios/ios41-allows-lease-to-expire-keeps-using-IP-address.html#chronology

Thank you,

Nils.

If the opposite ip address is a WAN address, it is the controller populating both the local ip address as well as the 3G ip address.  use "Enforce DHCP" on the AAA profile to make sure that secondary address does not enter the table.

You might want to simultaneously open a TAC case so that they are getting the details of your issue and can help you more quickly.

Hello

Here is the logs for the user when the issue happened:

(MAILMAN-LOCAL1) #show log user-debug 50 | include e0:f8:47:36:b5:ac
May 25 09:10:28 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac
May 25 09:11:00 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac
May 25 09:12:17 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac
May 25 09:14:55 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac
May 25 09:16:18 :501095:  <NOTI> |stm|  Assoc request @ 09:16:18.486355: e0:f8:47:36:b5:ac (SN 2690): AP 137.52.71.121-00:24:6c:c7:54:90-NMB-Terry-51
May 25 09:16:18 :501065:  <DBUG> |stm|  Client e0:f8:47:36:b5:ac moved from AP BL110_41 to AP NMB-Terry-51
May 25 09:16:18 :501065:  <DBUG> |stm|  Sending STA e0:f8:47:36:b5:ac message to Auth and Mobility Unicast Encr Open Multicast Encr Open VLAN 0x4db, wmm:0, rsn_cap:0
May 25 09:16:18 :500511:  <DBUG> |mobileip|  Station e0:f8:47:36:b5:ac, 0.0.0.0: Received disassociation on ESSID: NSU Mobility service ON, HA Discovery on Association Off, Fastroaming Disabled, AP: Name BL110_41 Group NMB-TERRY BSSID 00:0b:86:d7:17:70, phy a, VLAN 1243
May 25 09:16:18 :522036:  <INFO> |authmgr|  MAC=e0:f8:47:36:b5:ac Station DN: BSSID=00:0b:86:d7:17:70 ESSID=NSU VLAN=1243 AP-name=BL110_41
May 25 09:16:18 :500010:  <NOTI> |mobileip|  Station e0:f8:47:36:b5:ac, 255.255.255.255: Mobility trail, on switch 137.52.23.20, VLAN 1243, AP BL110_41, NSU/00:0b:86:d7:17:70/a
May 25 09:16:18 :501080:  <NOTI> |stm|  Deauth to sta: e0:f8:47:36:b5:ac: Ageout AP 137.52.68.241-00:0b:86:d7:17:70-BL110_41 STA has left and is deauthenticated
May 25 09:16:18 :501100:  <NOTI> |stm|  Assoc success @ 09:16:18.489211: e0:f8:47:36:b5:ac: AP 137.52.71.121-00:24:6c:c7:54:90-NMB-Terry-51
May 25 09:16:18 :501065:  <DBUG> |stm|  Sending STA e0:f8:47:36:b5:ac message to Auth and Mobility Unicast Encr Open Multicast Encr Open VLAN 0x4e0, wmm:1, rsn_cap:0
May 25 09:16:18 :500511:  <DBUG> |mobileip|  Station e0:f8:47:36:b5:ac, 0.0.0.0: Received association on ESSID: NSU Mobility service ON, HA Discovery on Association Off, Fastroaming Disabled, AP: Name NMB-Terry-51 Group NMB-TERRY BSSID 00:24:6c:c7:54:90, phy a, VLAN 1248
May 25 09:16:18 :522035:  <INFO> |authmgr|  MAC=e0:f8:47:36:b5:ac Station UP: BSSID=00:24:6c:c7:54:90 ESSID=NSU VLAN=1248 AP-name=NMB-Terry-51
May 25 09:16:18 :500010:  <NOTI> |mobileip|  Station e0:f8:47:36:b5:ac, 0.0.0.0: Mobility trail, on switch 137.52.23.20, VLAN 1248, AP NMB-Terry-51, NSU/00:24:6c:c7:54:90/a
May 25 09:16:18 :501105:  <NOTI> |AP BL110_41@137.52.68.241 stm|  Deauth from sta: e0:f8:47:36:b5:ac: AP 137.52.68.241-00:0b:86:d7:17:70-BL110_41 Reason STA has left and is deauthenticated
May 25 09:16:18 :501000:  <DBUG> |AP BL110_41@137.52.68.241 stm|  Station e0:f8:47:36:b5:ac: Clearing state
May 25 09:23:01 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac
May 25 09:23:34 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac
May 25 09:24:44 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac
May 25 09:25:24 :501102:  <NOTI> |stm|  Disassoc from sta: e0:f8:47:36:b5:ac: AP 137.52.71.121-00:24:6c:c7:54:90-NMB-Terry-51 Reason STA has left and is disassocisted
May 25 09:25:24 :501065:  <DBUG> |stm|  Sending STA e0:f8:47:36:b5:ac message to Auth and Mobility Unicast Encr Open Multicast Encr Open VLAN 0x4e0, wmm:1, rsn_cap:0
May 25 09:25:24 :500511:  <DBUG> |mobileip|  Station e0:f8:47:36:b5:ac, 0.0.0.0: Received disassociation on ESSID: NSU Mobility service ON, HA Discovery on Association Off, Fastroaming Disabled, AP: Name NMB-Terry-51 Group NMB-TERRY BSSID 00:24:6c:c7:54:90, phy a, VLAN 1248
May 25 09:25:24 :500010:  <NOTI> |mobileip|  Station e0:f8:47:36:b5:ac, 255.255.255.255: Mobility trail, on switch 137.52.23.20, VLAN 1248, AP NMB-Terry-51, NSU/00:24:6c:c7:54:90/a
May 25 09:25:24 :522036:  <INFO> |authmgr|  MAC=e0:f8:47:36:b5:ac Station DN: BSSID=00:24:6c:c7:54:90 ESSID=NSU VLAN=1248 AP-name=NMB-Terry-51
May 25 09:25:24 :501000:  <DBUG> |stm|  Station e0:f8:47:36:b5:ac: Clearing state
May 25 09:25:29 :501109:  <NOTI> |AP BL110_41@137.52.68.241 stm|  Auth request: e0:f8:47:36:b5:ac: AP 137.52.68.241-00:0b:86:d7:17:60-BL110_41 auth_alg 0
May 25 09:25:29 :501093:  <NOTI> |AP BL110_41@137.52.68.241 stm|  Auth success: e0:f8:47:36:b5:ac: AP 137.52.68.241-00:0b:86:d7:17:60-BL110_41
May 25 09:25:29 :501095:  <NOTI> |stm|  Assoc request @ 09:25:29.214864: e0:f8:47:36:b5:ac (SN 42): AP 137.52.68.241-00:0b:86:d7:17:60-BL110_41
May 25 09:25:29 :501100:  <NOTI> |stm|  Assoc success @ 09:25:29.215795: e0:f8:47:36:b5:ac: AP 137.52.68.241-00:0b:86:d7:17:60-BL110_41
May 25 09:25:29 :501095:  <NOTI> |AP BL110_41@137.52.68.241 stm|  Assoc request @ 09:25:29.530010: e0:f8:47:36:b5:ac (SN 42): AP 137.52.68.241-00:0b:86:d7:17:60-BL110_41
May 25 09:25:29 :501065:  <DBUG> |stm|  Sending STA e0:f8:47:36:b5:ac message to Auth and Mobility Unicast Encr Open Multicast Encr Open VLAN 0x4d0, wmm:0, rsn_cap:0
May 25 09:25:29 :500511:  <DBUG> |mobileip|  Station e0:f8:47:36:b5:ac, 0.0.0.0: Received association on ESSID: NSU Mobility service ON, HA Discovery on Association Off, Fastroaming Disabled, AP: Name BL110_41 Group NMB-TERRY BSSID 00:0b:86:d7:17:60, phy g, VLAN 1232
May 25 09:25:29 :522035:  <INFO> |authmgr|  MAC=e0:f8:47:36:b5:ac Station UP: BSSID=00:0b:86:d7:17:60 ESSID=NSU VLAN=1232 AP-name=BL110_41
May 25 09:25:29 :500010:  <NOTI> |mobileip|  Station e0:f8:47:36:b5:ac, 0.0.0.0: Mobility trail, on switch 137.52.23.20, VLAN 1232, AP BL110_41, NSU/00:0b:86:d7:17:60/g
May 25 09:25:29 :501100:  <NOTI> |AP BL110_41@137.52.68.241 stm|  Assoc success @ 09:25:29.533719: e0:f8:47:36:b5:ac: AP 137.52.68.241-00:0b:86:d7:17:60-BL110_41
May 25 09:25:33 :522026:  <INFO> |authmgr|  MAC=e0:f8:47:36:b5:ac IP=137.52.232.143 User miss: ingress=0x17f4, VLAN=1232
May 25 09:25:33 :522006:  <INFO> |authmgr|  MAC=e0:f8:47:36:b5:ac IP=137.52.232.143 User entry added: reason=Sibtye
May 25 09:25:33 :522050:  <INFO> |authmgr|  MAC=e0:f8:47:36:b5:ac,IP=137.52.232.143 User data downloaded to datapath, new Role=NSU/59, bw Contract=0/0,reason=New user IP processing
May 25 09:25:33 :522026:  <INFO> |authmgr|  MAC=e0:f8:47:36:b5:ac IP=137.52.232.143 User miss: ingress=0x17f4, VLAN=1232
May 25 09:25:33 :522050:  <INFO> |authmgr|  MAC=e0:f8:47:36:b5:ac,IP=137.52.232.143 User data downloaded to datapath, new Role=NSU/59, bw Contract=0/0,reason=New user IP processing
May 25 09:25:50 :501114:  <NOTI> |stm|  Deauth from sta: e0:f8:47:36:b5:ac: AP 137.52.71.121-00:24:6c:c7:54:90-NMB-Terry-51 Reason 255
May 25 09:27:21 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac
May 25 09:27:53 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac
May 25 09:29:13 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac
May 25 09:31:25 :522005:  <INFO> |authmgr|  MAC=e0:f8:47:36:b5:ac IP=137.52.243.103 User entry deleted: reason=idle timeout
May 25 09:35:22 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac
May 25 09:35:57 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac
May 25 09:37:11 :501065:  <DBUG> |stm|   Get Next/Get Request mac is e0:f8:47:36:b5:ac

In addition:

May 25 08:40:00  mac-auth-req          ->  e0:f8:47:36:b5:ac  00:24:6c:c7:54:80  -     -  
May 25 08:40:00  mac-auth-success      <-  e0:f8:47:36:b5:ac  00:24:6c:c7:54:80  -     -  
May 25 08:40:00  station-data-ready     *  e0:f8:47:36:b5:ac  00:00:00:00:00:00  1217  -  
May 25 08:40:00  station-up             *  e0:f8:47:36:b5:ac  00:24:6c:c7:54:80  -     -  open system
May 25 08:40:00  station-data-ready     *  e0:f8:47:36:b5:ac  00:00:00:00:00:00  1217  -  
May 25 08:45:46  station-down           *  e0:f8:47:36:b5:ac  00:24:6c:c7:54:80  -     -  
May 25 08:51:29  station-up             *  e0:f8:47:36:b5:ac  00:0b:86:d7:17:70  -     -  open system
May 25 08:51:29  station-data-ready     *  e0:f8:47:36:b5:ac  00:00:00:00:00:00  1243  -  
May 25 09:16:17  station-down           *  e0:f8:47:36:b5:ac  00:0b:86:d7:17:70  -     -  
May 25 09:16:17  station-up             *  e0:f8:47:36:b5:ac  00:24:6c:c7:54:90  -     -  open system
May 25 09:16:17  station-data-ready     *  e0:f8:47:36:b5:ac  00:00:00:00:00:00  1248  -  
May 25 09:25:24  station-down           *  e0:f8:47:36:b5:ac  00:24:6c:c7:54:90  -     -  
May 25 09:25:28  station-up             *  e0:f8:47:36:b5:ac  00:0b:86:d7:17:60  -     -  open system
May 25 09:25:28  station-data-ready     *  e0:f8:47:36:b5:ac  00:00:00:00:00:00  1232  -  
May 25 10:01:05  station-down           *  e0:f8:47:36:b5:ac  00:0b:86:d7:17:60  -     -  
May 25 10:01:05  station-up             *  e0:f8:47:36:b5:ac  00:24:6c:c7:54:90  -     -  open system
May 25 10:01:05  station-data-ready     *  e0:f8:47:36:b5:ac  00:00:00:00:00:00  1234  -  
May 25 10:18:04  station-down           *  e0:f8:47:36:b5:ac  00:24:6c:c7:54:90  -     - 

May 25 08:40:00  mac-auth-req          ->  e0:f8:47:36:b5:ac  00:24:6c:c7:54:80  -     -  
May 25 08:40:00  mac-auth-success      <-  e0:f8:47:36:b5:ac  00:24:6c:c7:54:80  -     -  
May 25 08:40:00  station-data-ready     *  e0:f8:47:36:b5:ac  00:00:00:00:00:00  1217  -  
May 25 08:40:00  station-up             *  e0:f8:47:36:b5:ac  00:24:6c:c7:54:80  -     -  open system
May 25 08:40:00  station-data-ready     *  e0:f8:47:36:b5:ac  00:00:00:00:00:00  1217  -  
May 25 08:45:46  station-down           *  e0:f8:47:36:b5:ac  00:24:6c:c7:54:80  -     -  
May 25 08:51:29  station-up             *  e0:f8:47:36:b5:ac  00:0b:86:d7:17:70  -     -  open system
May 25 08:51:29  station-data-ready     *  e0:f8:47:36:b5:ac  00:00:00:00:00:00  1243  -  
May 25 09:16:17  station-down           *  e0:f8:47:36:b5:ac  00:0b:86:d7:17:70  -     -  
May 25 09:16:17  station-up             *  e0:f8:47:36:b5:ac  00:24:6c:c7:54:90  -     -  open system
May 25 09:16:17  station-data-ready     *  e0:f8:47:36:b5:ac  00:00:00:00:00:00  1248  -  
May 25 09:25:24  station-down           *  e0:f8:47:36:b5:ac  00:24:6c:c7:54:90  -     -  
May 25 09:25:28  station-up             *  e0:f8:47:36:b5:ac  00:0b:86:d7:17:60  -     -  open system
May 25 09:25:28  station-data-ready     *  e0:f8:47:36:b5:ac  00:00:00:00:00:00  1232  -  
May 25 10:01:05  station-down           *  e0:f8:47:36:b5:ac  00:0b:86:d7:17:60  -     -  
May 25 10:01:05  station-up             *  e0:f8:47:36:b5:ac  00:24:6c:c7:54:90  -     -  open system
May 25 10:01:05  station-data-ready     *  e0:f8:47:36:b5:ac  00:00:00:00:00:00  1234  -  
May 25 10:18:04  station-down           *  e0:f8:47:36:b5:ac  00:24:6c:c7:54:90  -     - 

That data is inconclusive.  Please open a TAC case so that they can get the details of it.