Wireless Access

I have an issue where multiple Samsung android devices are not added to the user table when connecting to our guest SSID.  All of them are able to obtain an IP address.  Their default gateway even shows an ARP entry for the device.  However, no entry in the user table so the device can't hit the captive portal to login.  I am testing with the following devices: (2) Samsung Notes on different firmwares, Samsung Galaxy S3 & S4, and a Samsung tablet.  I can connect any iOS device to guest and it does not have this issue.  I know it's not Android specific as I'm seeing other Android devices in the user table, but I'm unsure of the manufacturer.

 

I'm running AOS 6.2.1.3.  Also, I have a case open w/ TAC, and wanted to get some feedback from the community while support works on this.

Do you see these devices in a "show station-table" output?

 

Not seen this personally...

 

 

Are you able to see them in the show ap association ?

 

 

Is this happening on both roles : captiveportal-logon-role and guest ?

Yes, I see the devices in the station table and I can see them associated to an AP.

 

This is happening for the captive portal role, but not guest since they can't get to the CP for logon.

Yes, that would follow.

 

I've got a theory.

 

What happens if you set a valid static address on the device? Can you do that?

 

Assumes you haven't prevented the use of statics in your Aruba config of course.

 

We're not enforcing DHCP.  I set the IP statically on the device and had the same result as before.  Device shows up as associated, but not in the user table.

 

The captive portal is on ClearPass.  The devices do not get redirected to the captive portal.

That ruins my theory! Thought it might have been dhcp issue of some sort.

You'll never of course get the cp until you're in the session table.

This is very odd.

I think the next thing to look at would be a "show ap tech" output from an ap when one of these devices is attached to it.

Anything in particular that would be of concern in the output of show ap tech?

 

Latest response from TAC is install 6.3. :smileyindifferent:

If I had the output, I'd be looking for salient information about the client connection state at layer 2 and 3 (if any). Probably by searching for the client mac. Really looking for anything clearly wrong.

 

I think you should ask the TAC for rationale for that recommendation. If none, you're within your rights to ask for escalation.

Yeah, I parsed through the output and the only thing interesting I found was that the client was listed as interferring for sta-type.  Never seen that before.

 

Asked the engineer to determine the issue or escalate me.  We'll see where this goes.  I'll keep the thread updated as I get information that is helpful in resolving this issue.

The issue is no longer just a Samsung device issue.  I tested with a Nexus 7 on kit-kat and it has the same problem.

 

TAC and I were troubleshooting for several hours and tried the following:

 

1) Set controller as default gateway on the client to force the client to ARP for the controller.

Controller never made an ARP entry for the client or put it in the user table.

 

2) Created new SSID with default everything except for the VLAN # and SSID.

Didn't help.

 

3) Created an isolated VLAN on the controller, created a DHCP pool for it on the controller, and mapped that VLAN to the new SSID.  The client received an IP address from the controller, but still was not entered into the user table.

 

Next step is a packet capture for TAC to analyze.

Hi

Do u have any update regarding this issue?

 

Please advise.

 

Me

Upgraded to 6.3 and it's still an issue.

It's - Not good :(

 

Thanks for the update.

 

Which 6.3? (6.3.1.3 or 6.3.1.2)

 

 

6.3.1.2

Thanks for the update.

I now have a few onboarded Androids that can connect to the secure corporate network, but they won't show up in the user table.  So it's not an issue with the guest network.  Seeing this with several different Samsung models and a Motorola Moto X.  Opening a new ticket with TAC.  Still no one else has run into this?

Did this ever get resolved?  I have a client seeing similar symptoms with a Cisco IP phone - associates to the ssid, authenticates, placed in role, gets ip address from dhcp, but never added to the user-table.

 

Thanks for any update...

 

So the device is not able to see the Captive Portal page ?

 

Is this a controller captive portal or ClearPass guest ?