Controllerless Networks

last person joined: yesterday 

Instant Mode - the controllerless Wi-Fi solution that's easy to set up, is loaded with security and smarts, and won't break your budget
Back to discussions
Expand all | Collapse all

Aruba IAP Session time out with 3rd party AAA Manager

This thread has been viewed 1 times

  • 1.  Aruba IAP Session time out with 3rd party AAA Manager

    Posted May 04, 2017 03:39 AM

    Hi,

    We have 16 IAP deployed and working well. we have added an AAA Manager for guest access, The issue is some users when connected to the “Guest” SSID with acptive portal and move into areas with no Wi-Fi coverage, the device gets disconnected from Wi-Fi network.

    after that aruba iap removes sessions after a certain time period if they do not come back into signal range. This timeout is changing idle timeout parameters on Aruba don’t have any effect & Once user gets disconnected on Aruba, AAA Manger removes idle sessions for which there is no session on Aruba.

     

    When user moves back into Wi-Fi signal range, the old session is no longer available and Aruba creates a new session where user is unauthenticated.

    User is now connected to Wi-Fi but is not authenticated. user has to reauth for internet access.User feels that Internet is not working

     

    Is their any workround to maintain session table in iap for some 10 minutes or above.



  • 2.  RE: Aruba IAP Session time out with 3rd party AAA Manager

    EMPLOYEE
    Posted May 04, 2017 08:07 AM

    Typically the IAPs would be configured to do mac authentication to the AAA manager.  The AAA manager would be a radius server that would mac authenticate users and allow them onto the network if they authenticated successfully before.

     

    You could extend the "inactivity timeout" parameter in the SSID profile to accomplish sort of the same thing:  http://community.arubanetworks.com/t5/Controller-less-WLANs/How-do-I-configure-VLAN-pooling-in-Aruba-Instant/ta-p/179078

     

    The downside of extending the inactivity timeout is that users that authenticate and go away still consume resources, and the user count on the instant virtual controller is inflated artifically.  That gives an inaccurate view of who is on the network, but also ties up resources.