Wireless Access

So i'm working on an interesting setup and noticing some connectivity issues with users. We have an LTE connected router with a switch and a couple AP-325's attached. The Router is connected via VPN back to our network and connects to our controller pair at our Data Center. The Controllers are 7220's running 6.4.4.16 code. 

 

In testing, I found that the AP keeps failing between the primary and backup HA members constantly - causing users to not get connected to the controller or get an IP address. I also think the BSSIDs keep resetting each time, which may be normal and expected as it rebuilds it's GRE tunnel. 

 

My question is can I adjust the HA failover values / timeouts for these specific APs? Is there any concern over MTU values if it's a Campus AP going over a VPN (I don't know MTU value on VPN). Any other suggestions to help stabilize the APs? 

 

As as FYI, there is no packet loss is high latency when hardwired to the switch with a PC.

 

Thanks for the help

HA is designed for fast, low latency networks.  I would try either VRRP or backup lms to avoid any issues over a WAN circuit.

Thanks for the feedback. So this particular controller hosts about 800 APs
from remote offices over MPLS successfully, so maybe I can convert these to
RAPs and leverage our dedicated RAP controllers that are setup as
LMS/Backup LMS or even leave them as CAPs and point to the inside
addresses. At least then we aren't changing the dynamic of the existing
devices. I'll investigate these possibilities tomorrow, but I think that is
a good test plan.

To follow up here, we resolved the issue. Not sure if it was MTU related or having a GRE tunnel (AP to Controller) inside a GRE tunnel (LTE Router to Cellular Provider), but we converted the AP-325's to RAPs and were able to get them up and stable. 

 

I did initially try VRRP over HA, but still saw the same result. I also removed the Backup LMS all together, and still saw the BSSIDs reset every 15 seconds or so. Ultimately the solution was to make them RAPs using IPSEC. I did not have a chance to try CPSEC to see if that would have fixed it, but i imagine it would have been similar result. 

 

Thanks for the help.