Wireless Access

I have an ap that is provisioned and working great at a main campus. When I take the AP to a remote warehouse connected by VPN, the AP will come up in the controller (slowly) but it will not broadcast the SSIDs. It also shows a D flag.

 

On top of the that, when I try to pull an AP tech-support log to review at the office, it will make it through 3/4 of the report and I'll see this start repeating:

[  130.563261] asap_gre_ipv4_err: Received ICMP (DEST_UNREACH, PROT_UNREACH) from 172.29.30.6 for heartbeat tunnel.
[  131.565280] asap_gre_ipv4_err: Received ICMP (DEST_UNREACH, PROT_UNREACH) from 172.29.30.6 for heartbeat tunnel.
[  132.567292] asap_gre_ipv4_err: Received ICMP (DEST_UNREACH, PROT_UNREACH) from 172.29.30.6 for heartbeat tunnel.
[  133.569669] asap_gre_ipv4_err: Received ICMP (DEST_UNREACH, PROT_UNREACH) from 172.29.30.6 for heartbeat tunnel.

 The AP will never recover and I have to reboot it to start all over.

 

I wanted to get your thoughts on it and where I could go next to troubleshooting the issue. MTU sizes have been changed in the past with no effect. There is also another thread on here from the customer talking about the issue.  http://community.arubanetworks.com/t5/Unified-Wired-Wireless-Access/Remote-AP-connection-via-IPsec/m-p/225604

 

You should try pinging a device on that network behind the VPN with varying packet sizes with the -DF option to see the largest size that it would pass successfully.  The GRE tunnel required to send user traffic to an AP could add 46 bytes to a packet, so you probably need to find what the largest ping size that can be handled, subtract 46 from it and make that the MTU in the AP system profile as a start; Otherwise, you need to make sure that the site to site VPN allows GRE or protocol 47 to pass through.
EDIT: Protocol 47 for GRE, than you Michael_Clarke

protocol 47 for GRE

Thanks Colin, I'll try it out.