Controllerless Networks

Hi

 

We have been have a problem with our iPad’s and our Aruba Instant Wireless network that I would like some help with.

 

We have the following setup, SSID set to use and external radius server for authentication and connects to our corporate network VLAN, users can connect to and Authenticate fine, they can then browse or get email etc…

But after a period of time even though the iPad says that it is still connected to the WiFi the users can no longer browse or connect to any network resources, then after 15 – 30 mins it starts working again.

 

Has any one had any similar problems or have an idea of how to solve the problem

 

Thanks in advance

 

What IAP model and what version of code do you have running?

 

We are running IAP-105 and we are running 6.1.3.1-3.0.0.2_34479 of the OS, I upgraded it last week to see if it would solve the problem.

 

We have been having the problem with all generations of the iPad.

 

 

Do you only have a single SSID or do you have multiple SSIDs?  How many IAP 105s do you have?

 

 

 

We have 3 SSIDs,

 

1 Guest with captive portal

1 Guest no captive portal

1 Corporate Network

 

We have 10 IAP-105s over 2 floors.

 

The Corporate Network is the one we are having problems with, we don't get any problem with laptops that are connected to the same SSID.

 

You will probably need to open a case to get to the bottom of this, because they will need your tech support logs at the time this is happening.

 

Meanwhile, it would be interesting to see if anyone has the same issue.

 

Helpful information from Cisco TAC:

 

• Apple does not support OKC. Cisco has developed code to support their “sticky key caching”. This is an enhancement for iDevices doing 802.1x – this cuts the roam time since keys are available at the AP.

 

• iDevices have a built-in 20 minute timer for Internet access. If the device is not active the timer begins a countdown. If it does not connect to the Internet during the countdown time, the device will jump off the network and require reauth.

 

• iDevices have different max Tx Power level
  o 20mW device - iPhone/iPod/iPod Touch
  o 40mW device - iPad(1/2/3)
  o iDevices need to run “hotter” than other wireless devices - more tx power

 

• iDevices prefer Broadcast SSID’s
  o If the device has multiple “saved” WLANs and profiles, it will always prefer the Broadcast WLAN; the device will change to the Broadcast SSID even if you select a closed/secure SSID

 

• iPhone requires that 11M data rate be set to MANDATORY. This will slow your overall network, but this has been thoroughly tested by our TME group in San Jose. If the 802.11b rates are completely disabled, the iPhone will have connectivity problems

 

------------------------------------

In your specific case, it looks like your device jumped off the network and require reauth at the end of the 20 minute timer.

Paul, that is great info. Do you have any links you can post for reference? I'd like to read up on that a little more.

http://www.my80211.com/home/2012/7/31/cisco-tac-reference-to-wireless-apple-i-devices.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+my80211%2Ffeeds+%28my80211.com%29

 

Instant aps do not support OKC.
All available rates should be advertised by default unless they have been changed.
An SSID is broadcast by default unless it is manually hidden.

If an i-device disconnects after 20 minutes of inactivity it should just reconnect and not be held off the network for 15 minutes.

Please open a support case so we can get to the bottom of this.

I opened a support case, and support have given me some commands to run, when the problem occurs.

 

The problem is that it hasn't oocured again since I made a change to the WIP settings to turn of containment for both wired and wireless. Not sure why this would be affecting the ipads?

 

Can you tell me if I am creating a hugh security risk by doing this?

 I cannot tell you why it has not happened, or if turning off containment really solves the issue.  Please communicate your findings to support so that they can analyze, since they have your tech support data.

---

@cjoseph wrote:
Instant aps do not support OKC.
All available rates should be advertised by default unless they have been changed.
An SSID is broadcast by default unless it is manually hidden.

If an i-device disconnects after 20 minutes of inactivity it should just reconnect and not be held off the network for 15 minutes.

Please open a support case so we can get to the bottom of this.

---

Do you know if it is supported in 6.2.x version of Instants?

cjoseph wrote:
Instant aps do not support OKC.

 

Is that still fact?

 

Thanks a lot!

IAP does not support OKC -- yet.   Keep an eye out for v.4.0 over the next week or so.  OKC support is being added in that release.

Thanks a lot!