Controllerless Networks

Hi Aruba team,

In the latest firmware 6.5.0.0-4.3.0.0_56428, once the defined user limit is reached for both 2.4GHz and 5GHz radio's, the following issues are seen.
1. Few users are being dis-associated
2. The dropped users can never be connected to the network again.
3. Remove(dis-associate) some of the users from 5GHz and try to connect them again. They cannot be associated again.

I have used the following commands for configuring "user Limits for Per-AP Radio Profiles".
a. a-max-clients <ssid_profile> <max-clients>
b. g-max-clients <ssid_profile> <max-clients>

Impacted Devices: The above mentioned issues are seen only with "IPAD MINI-2". devices. However, with all other types of devices such as Android or other Ipad devicecs(such as Ipad Air2, IPad Mini4), it just works fine.

Observation: While investigating, I have noticed that, Aruba is rejecting the user authentication requests with Status code 17.  The logs captured on the aruba side is pasted below.

Logs:18:64:72:c8:4f:ac# show a-max-clients profile-1
a-max-clients: 10
18:64:72:c8:4f:ac# show g-max-clients profile-1
g-max-clients: 5
18:64:72:c8:4f:ac#

Meanwhile, when logged into Aruba to ensure the AID limit is not reached(confirmed by show ap association command) also verified, the user limit is NOT reached.

Logs for reference:

----------------------------------------------------------------------------------------------

18:64:72:c8:4f:ac# show ap debug mgmt-frames

Traced 802.11 Management Frames
-------------------------------
Timestamp        stype   SA                 DA                 BSS                signal  Misc
---------        -----   --                 --                 ---                ------  ----
Dec  3 20:19:15  deauth  18:64:72:04:fa:c3  c0:f2:fb:19:7d:32  18:64:72:04:fa:c3  15      - (internal only)
Dec  3 20:19:10  deauth  18:64:72:04:fa:d3  6c:70:9f:7a:ff:33  18:64:72:04:fa:d3  15      - (internal only)
Dec  3 20:19:10  deauth  18:64:72:04:fa:d3  c0:f2:fb:19:7d:32  18:64:72:04:fa:d3  15      - (internal only)
Dec  3 20:19:05  deauth  18:64:72:04:fa:c3  6c:70:9f:7a:ff:33  18:64:72:04:fa:c3  15      - (internal only)
Dec  3 20:18:40  auth    18:64:72:04:fa:c3  c0:f2:fb:09:4d:67  18:64:72:04:fa:c3  15      AP is resource constrained (seq num 0)
Dec  3 20:18:40  auth    c0:f2:fb:09:4d:67  18:64:72:04:fa:c3  18:64:72:04:fa:c3  0       -
Dec  3 20:18:40  auth    18:64:72:04:fa:d3  c0:f2:fb:09:4d:67  18:64:72:04:fa:d3  15      AP is resource constrained (seq num 0)
Dec  3 20:18:40  auth    c0:f2:fb:09:4d:67  18:64:72:04:fa:d3  18:64:72:04:fa:d3  0       -
Dec  3 20:18:40  auth    18:64:72:04:fa:c3  c0:f2:fb:19:7d:32  18:64:72:04:fa:c3  15      AP is resource constrained (seq num 0)
Dec  3 20:18:40  auth    c0:f2:fb:19:7d:32  18:64:72:04:fa:c3  18:64:72:04:fa:c3  0       -
Dec  3 20:18:39  auth    18:64:72:04:fa:d3  c0:f2:fb:19:7d:32  18:64:72:04:fa:d3  15      AP is resource constrained (seq num 0)
Dec  3 20:18:39  auth    c0:f2:fb:19:7d:32  18:64:72:04:fa:d3  18:64:72:04:fa:d3  0       -
Dec  3 20:18:34  auth    18:64:72:04:fa:c3  6c:70:9f:7a:ff:33  18:64:72:04:fa:c3  15      AP is resource constrained (seq num 0)
Dec  3 20:18:34  auth    6c:70:9f:7a:ff:33  18:64:72:04:fa:c3  18:64:72:04:fa:c3  0       -
Dec  3 20:18:34  auth    18:64:72:04:fa:d3  6c:70:9f:7a:ff:33  18:64:72:04:fa:d3  15      AP is resource constrained (seq num 0)
Dec  3 20:18:34  auth    6c:70:9f:7a:ff:33  18:64:72:04:fa:d3  18:64:72:04:fa:d3  0       -
Dec  3 20:18:33  auth    18:64:72:04:fa:c3  c0:f2:fb:19:7d:32  18:64:72:04:fa:c3  15      AP is resource constrained (seq num 0)
Dec  3 20:18:33  auth    c0:f2:fb:19:7d:32  18:64:72:04:fa:c3  18:64:72:04:fa:c3  0       -
Dec  3 20:18:33  auth    18:64:72:04:fa:d3  c0:f2:fb:19:7d:32  18:64:72:04:fa:d3  15      AP is resource constrained (seq num 0)
Dec  3 20:18:33  auth    c0:f2:fb:19:7d:32  18:64:72:04:fa:d3  18:64:72:04:fa:d3  0       -
Dec  3 20:18:32  auth    18:64:72:04:fa:c3  c0:f2:fb:19:7d:32  18:64:72:04:fa:c3  15      AP is resource constrained (seq num 0)
Dec  3 20:18:32  auth    c0:f2:fb:19:7d:32  18:64:72:04:fa:c3  18:64:72:04:fa:c3  0       -
Dec  3 20:18:32  deauth  18:64:72:04:fa:c3  c0:f2:fb:19:7d:32  18:64:72:04:fa:c3  15      CM: Band Steer (seq num 0)
Dec  3 20:18:31  auth    18:64:72:04:fa:c3  c0:f2:fb:11:ec:f1  18:64:72:04:fa:c3  15      AP is resource constrained (seq num 0)
Dec  3 20:18:31  auth    c0:f2:fb:11:ec:f1  18:64:72:04:fa:c3  18:64:72:04:fa:c3  0       -

Traced 802.11 Management Frames

Let me know if you need any specific log. I can provide it.

Thank you.

What is your question?

The question is: Why do I have user connectivity issue when user limitation per profile is not reached? I have set user limit as 15(10 for 5GHz and 5 for 2.4GHz) on the profile however, only 10 users are connected and unable to connect more.

Please take time to go through my previous post where I have listed all the issues.

It could be a bug.  That parameter is rarely used.  I would open a TAC case so that they can replicate it with your configuration.

Thank you Colin. Really appreciate your help.

That per SSID radio limit was first introduced in Instant 4.3.0.0., so there could be an issue with it.

A hidden warning I see is that this should not be combined with Band Steering or Client Match enabled.

The issue still seen my WAP. I disabled both the client-match feature as well as band-steering.

Below, the settings from my Aruba WAP:

18:64:72:c8:4f:ac# show arm config

Minimum Transmit Power            :10
Maximum Transmit Power            :10
Band Steering Mode       :disable
Client Aware             :enable
Scanning                 :disable
Wide Channel Bands       :5ghz
80Mhz Support            :enable
160Mhz Support           :none
Air Time Fairness Mode   :fair-access
Client Match             :disable
CM NB Matching Percent   :60
CM Calculating Interval  :3
CM SLB Threshold         :5
CM SLB Client Threshold  :30
CM SLB Balancing Mode    :channel based
CM Max Request           :5
CM Max Adoption          :5
CM Hold Time             :300
CM Good SNR              :30
CM Bad SNR               :18
CM SNR Threshold         :10
CM VBR Report Interval   :30
CM VBR Stale Entry Age   :300
CM STA Stale Entry Age   :1000
CM Restriction Timeout   :10
CM Debug Level           :error
Custom Channels          :Yes
2.4 GHz Channels
----------------