Higher Education

Anyone having issues with roaming between AP delays just on Yosemite with 802.1X?

I know it is in Beta, but we have confirmed this on two different V.3 machines, two different generations Macbook Pros. The delay on reconnect takes about 10 seconds before the machine finishes completing the new connection. 

I have seen this with my laptop, but I haven't put much though into it as it hasn't distrupted anything that I've been working on.

I'll have to add it to my list of things to investigate.

I've had issues with the wireless on my iMac running Yosemite ( 10.10 beta 5 ) dropping and reconnecting frequently - sometimes not returning with an IP address.    

It appears to still be an issue even with the full release of 10.10. 

It appears that this issue is with Yosemite itself. It's being seen across many wireless vendors. Every OS X release seems to add new wireless issues. Some (like this roaming issue) seem to reoccur every few releases.

You should try opening a case with Apple support.

I wouldn't doubt that it could be an Apple issue, but I seem to recall seeing a similar issue on my mac when Aruba introduced client-match. I think we had to tweak our client match settings. If my memory is correct it was because our 802.1X is using WPA and not WPA2. I could be way of the mark here, but maybe not...

I found an issue with Yosemite on one of my ssids.  

I had max-tx-fail set to 25   (I beleive a pre client-match way of dealing with sticky clients)

the default is 0 (unlimited fails)

returning max-tx-fail to 0 - appears to have resolved the issue.    At least for my macbook that I was forcing into the problem state.   I only just made this change today and await feedback from the users.....

.... so ..... yeah....

Please see if this is pertinent to your problem ssids and test and report back as well.

I have reports from a student on Yosemite that with his MacBook when he gets back to his room it can take 20 minutes to get back on the .1x network.  He also happens to have an AP in his room.  We looked at the laptop and did the normal checking/tweaking (network priority, forget the guest network, disable aggressive roaming, etc...) but the problem persists.

We're running 6.4.2.2.  I'm not sure if requiring 802.1x was just too much and/or if the expectation for wireless has skyrocked this year but these mac 'tweaks' for every OS version is really not helping.

We are also seeing some odd roaming issues.  Usually restarting the machine causes the device to connect immediately.   The odd thing is we are not even seeing anything in our logs when the issues appear.  Because we are not seeing anything in the aruba logs we are thinking this must be driver related issues with the latest OSx.  We are seeing most of our issues on devices manufactured before 2013.

Looks to be the authentication chain delays again, just like in early Mavericks. 

Head into Keychain, go to Certificates, then open each certificate in the chain and set the Extensible Authentication (EAP) to "Always Trust". 

If this works for you, please post up here. 

Changing the Keychain trust settings doesn't seem to work, even with 10.10.1. Back to the drawing board.....

I would like to confirm what theiglu shared just now, that 10.10.1 does not seem to address the roaming issue.

Confirmed that without changing any trust settings in the certificate chain in Keychain, it takes between 10 to 17 seconds to reconnect when roaming. 

Just now I set the entire certificates to "Always Trust", not just EAP, and I have less than a second delay on roaming. Will continue to experiment and post results here. 

The students in the library are starting to be confused by the IT guy walking back and forth across the large room over and over while staring at a computer......

Can you get ahold of one of these MACs running Yosemite and connect it to the wireless; then start a packet capture using wireshark on the wireless interface and filter by eap. Once the capture is started, just do a quick walk around with the device so we can see what it looks like when it is trying to roam.

Will do, just finishing backtracking my Keychain settings. 

Right now, I have both the Thawte SSL CA and Thawte Primary Root CA set back to "System Default" on the trust settings. Roaming is still within a second. The only certificate that isn't on default system settings is our internal NPS server certificates for 802.1X. That is still set to "Always Trust" for the entire certificate. I'll start narrowing down the individual trust settings in there to see which one is the holdup. I've already tried EAP last time. Apparently that wasn't it. 

This was a clean load of 10.10.1 as of yesterday, no other modifications. 

Ive had pretty good luck setting SSL, EAP, and X.509 to always trust, re-auth times according to wireshark are always under a second, completley un-noticeable unless you are looking at wireshark when you roam.

Removed all custom settings from Keychain. Tried to roam, still quick and working properly. Rebooted hoping to get it back to a failure state. No luck. Removed all Wifi SSID profiles, removed all entries and certificates from Keychain, reconnected fresh. Still no issue roaming. 

Will wipe the machine again and start fresh with a 10.10.1 clean install. 

Very difficult to troubleshoot something if you can't duplicate the problem.

I would be interested to see anything in a log on this issue.  I have set a handful of our problem machines running 10.10.x and when they are having roaming issues the wifi cards are not sending any packets and or communicating at all with the aruba gear...

The fact that turning off and on the wifi adapter fixes the problem instantly leaves me to believe that it is a software/driver issue...

That being said - we have ONLY seen this issue on MacBook Pro devices (2012, 2013, and the latest models) seem to have this issue atleast once a day.