Wireless Access

I have a RAP in a remote location and it was working great for the users for several months.  However, the users started complaining that they are getting disconnected several times throughout the day.  They'll get disconnected, and about 2 minutes later, they'll reconnect.  show ap debug system-status shows that the RAP has been up for several months so I know it's not rebooting.

 

My best guess is that there's a lot of interference from neighboring businesses APs causing the disconnects.  In a day, the AP changes channels about 20 times, mostly due to interference or error threhold exceeded.  I've had the users make note of when they get disconnected, but I can't correlate it with a channel change or any other event logged on the AP at the time.  Also, the users say that the SSID they connect to disappears after they get disconnected and reappears when they get reconnected.  I'm not sure if it's possible that's due to interference, but I'm going to assume that it is and work from there.  That being the case, is there anything I can do to combat the excessive interference? All the clients are only 802.11bgn capable, so I'm stuck using 2.4GHz for now.

 

Also, is there a command that will show me if the IPSEC tunnel is going down?

Can we enable user-debug on the controller so that we could keep track of user behavior when the issue occurs.

 

From CLI configuration mode:-

-----------------------------------------

logging level debugging user-debug <mac address of the user>

 

 

"show AP bss-table" should give the up time of the AP and "show crypto ipsec sa" would give the information about IPSec Tunnel

.

(Aruba) #show crypto ipsec sa

IPSEC SA (V2) Active Session Information
-----------------------------------
Initiator IP Responder IP SPI(IN/OUT) Flags Start Time Inner IP
------------ ------------ ---------------- ----- --------------- --------
10.10.10.2 10.10.10.1 4f11ff00/6c225c00 UT2 Jul 18 19:23:11 10.10.10.2

 

Check for noise floor, retry/mac-error on the channels to see the stats of the AP on the specific channel.

"show ap debug client-table ap-name" would give the information about the percentage of client retries, SNR, tx/rx rate of the client/PS mode etc.. Please verify.

Please do the rft test for the link quality to understand the client performance. See below for example:-

 

(Aruba) #rft test profile link-quality ap-name Test dest-mac <client mac address> phy g

Aruba) #show rft result all

 

Please make sure we dont have any non-wifi interference on the client physical location like cordless phones, Bluetooth,wireless camera, microwave oven etc.

You had mentioned SSID disappears; do we see a low SNR or signal strength on the client itself at point of time?

Can you post the show AP monitor AP-list AP-name & show AP arm neighbors AP-name to see the neighboring interfering AP`s and at what SNR value or how strong is the interference?

If we are able to identify the issue with interference; please disable the arm scanning on the specific AP to see if that helps.

 

Thanks much

 

do you see a lot of devices interfering if you run this command :
Show ap monitor ap-list ap-name <apname>

vfabian,

 

I see 7 interfering APs.

 

Attached is the output from the command.

 

 

Sriram,

 

I've been debugging the AP and user for the last day. This user had several issues yesterday so I will compare the times she got disconnected with what's in the log and get back to you.

 

The AP uptime is high so I know the device is not rebooting.  The IPSEC uptime is questionable though.  The "Start Time" for all of the RAPs is this morning at different times.  Should that be a concern?

 

You had mentioned SSID disappears; do we see a low SNR or signal strength on the client itself at point of time?

 

I don't see any SNR issues.  Typically 40+.

 

Can you post the show AP monitor AP-list AP-name & show AP arm neighbors AP-name to see the neighboring interfering AP`s and at what SNR value or how strong is the interference?

 

I've attached the output.  Show ap arm neighbors isn't displaying anything though.  Wasn't sure if this was something a RAP can't do.

 

If we are able to identify the issue with interference; please disable the arm scanning on the specific AP to see if that helps.

 

 

What does disabling ARM scanning accomplish?

So should I be concerned if the Start Time for show crypto ipsec sa is always about an hour or two ago for every RAP any time I run the command?  I'm concerned that this indicates the IPSEC tunnel is going down/up often.

 

can you look at the RAP uptime show ap active <rapname>

 

And also look at the show ap debug system-status <rapname> and show ap details <rapname> and see if the RAP has been rebootstrapping or missing hearbeats 

 

 

 

 

 

Hey Victor,

 

show ap active had a high uptime until I rebooted it a few days ago.  Uptime was a few months.

 

show ap debug system-status ap-name shows several hearbeats missed over the last couple of days.  I can correlate heartbeats missed yesterday with the RAP being reported down by Airwave.  The current start time for that RAP is 7/23 @ 06:36.  I don't see any heartbeats missed at that time.  So it doesn't appear as though heartbeats always equates to the IPSEC tunnel being rebuilt, but it was in at least one instance.

 

The IPSec gets renegotiated every 86400 Secs /24 Hrs (Maximum Value) by default unless you changed it to a lower value 

vfabian,

 

All of the IKE and IPSec maps have the default lifetime set.  The start time is consistently less than 2 hours for every RAP connected.  I'm not sure if that indicates IPSec flapping or not.

 

 

Please look for show ap bss-table ap-name <name of the ap>
Above output will confirm the actual up time of the BSSID been broadcasted by the AP.

 

Show ap debug system-status ap-name <name of the ap>
This stats will give the last reboostrapping time of the ap for what reason and this correlate with the bss-table and on your airwave uptime.

 

If the above outputs are showing up for long time; then we ar good that there is no drop from the RAP IPSec back to controller.

From your attached output, we could see a interfefing AP`s on channel 1 however there rssi doesnt seems to be harmful.

I would recommend next step would be below things.

 

1. Confirm RAP is stable and IPSec tunnel is not flapping.
2. Please upload the tech-support config to review the config
3. You can also enable the spectrum mode on any of the ap and do the RF scan to understand the inteference on
    network more effectively. Please find attached user-guide and procedure to configure spectum monitor is described on page          no:631, chapter 34.
4. Reason being to recommend to disable arm on specific AP is to remove that specfic ap from the arm calculations and remove
    scannig from network so AP wouldn`t switch channels due to arm calculations or any errors on the radio.

 

 

****************************************************************************
Aruba Airheads - Powered By community for empower the community
************ Don't Forget to Kudos + me,If i helped you******************

 

To my understanding if the IPSec tunnels drops your RAP connectivy back your controller. Unless its recovering too fast ?

You should also enable logging debugging security process crypto and see if there's something in the logs that shows whats occurring .

If this is happening to several users then may want to check your ISP connection back to your campus or your layer 1 connections going back to the controllers