Wireless Access

Hi all -

 

Not sure this is the correct board - but I'm stumped. We have an Aruba 3400 controller running 6.3.1.5, 30 APs/Raps connected from various locations and things have been running well. But recently when people are logging onto their computer (windows specifically) when they get to the windows logon screen, after entering their credentials, there can be a long delay (3 minutes to 20 minutes) for the system to log into windows if their wireless card is active. If we turn off the wireless card, they log in within 10-15 secs.

 

I"m stumped - I figure it has something to do with authentication on the systems (we use machine and user auth, going to an LDAP server (radius))

 

Once they are at their desktop you can turn wireless back on and the system works fine.

 

Any thoughts would be greatly appreciated.

Lirra

#3400

Looks like its syncronizing something.... and thats why its taking soo long...

Do you know if its syncronizing something? before login in?

If you connect that laptop to a wired network how much does it takes???

 

You mention you turned off the wireless but not if you were connecting to the wired network.

 

Cheers

Carlos

Other than the normal windows stuff - we aren't doing much, We have a group policy that runs after login to backup files (which doesn't work when only wireless)

 

When only wired, things are fine, when wireless and wired are both on, depending on priority, it can be slow.

 

Now to add more oddness into this - I don't see this much in my office (I'm with the controller, but I also don't log in on wireless much) We do see it when we have visitors from other offices, and we have one office in CA that seems to get this issue alot.

 

They have AP105's installed connecting back to us over a MPLS circuit.

 

Lirria

mmm does it just happen during logon?

If you disconnect the pc from the wireless network while you are on the session and you also then delete the entry from the aaa user table on the controller and reconnect again, does it takes time to connect? or it connect really fast...

If it connect really fast its nothing related to the authentication or connection... and its something else...

 

Cheers

Carlos

 

Hmm - interesting thought -I haven't tried that - let me see if I can find one with the issue and test.

 

Lirria

Yes let see if its somehow an authentication delay or anything...

Remenber to delete de entry from the user table!

 

But i do still bealive its something that its syncronizing during the logon.... thats the only thing that im aware of that can make that behavior happens....

If its an authentication issue it will just tell you that it as not able to connect and continue with the logon process...

Are you enforcing machine authentication?  If so, the role may be too restrictive.  I've found that if you block mapped drive destinations this significantly increases profile load time.

OK - just where do I find that setting - it's been awhile since I've configured this controller?

 

Lirria

You can check it

Its on configuration --->authentication --->aaa profile--->Select the profile you are using for those machines ---->Click on 802.1x authentication--->see if  enforce machine authentication is checked

 

by the way, what happened when you disconected your computer and deleted from the user table that machine on the controller??

Did it take a lot of time to connect? or you can reconnect it really fast?

 

Cheers

Carlos

So to the first question - yes we do machine auth - I was questioning how to stop the mapped drives from loading - that I don't know how to do

 

To the second question -  just had a person with the issue in CA, when I looked in the controller user table - they however where not listed. (bummer)

 

Lirria

Stopping the mapped drives is a function of your Windows group policy. I
would recommend finding out where all of your mapped drives are located and
allow the machine authentication role access to them.

I wondered - I'll have to look into that to test if that is the issue - of course the person that had the issue, took a walk and now they are logged into the computer and still not showing on the controller.

 

:(

 

Lirria

As a test, you could try is giving his computer the "authenticated" role when it machine authenticates, giving it full access to the network as it logs on.  If logon is faster than you know it's because of something being blocked during the logon process.  Not sure what you have for a RADIUS server, but if you use ClearPass it would be very easy to assign only this laptop the authenticated role.