Wireless Access

All,

I have set up a MM based design for a customer, and have a RAP connected over the Internet to the VRRP VIP of the controllers.

From my phone I can connect fine to any broadcasted SSID.

But when I try the same thing from my workstation I am unsuccessful.

When I check the user log on the controller, this is what I see for every failed attempt:

Dec  3 16:07:57  stm[1194]:  <501080> <NOTI> |AP rap-steven@10.255.255.1 stm|  Deauth to sta: e4:a4:71:aa:8d:c2: Ageout AP 10.255.255.1-84:d4:7e:c3:cd:19-rap-steven UAC Down

The same message is shown regardless of whether security settings are set to 802.1x, PSK or None.

I was unable to find any information online related to the "UAC Down" message, so I'm hoping you guys can help me out!

Are you running those two controllers in a cluster?

I am, and the cluster is L2 connected.

I tested using campus APs and the issue does not occur in that case. It's only a problem with RAP connectivity.

Hello Steven,

have you further investigated this issue?

We see similar behavior, but with CAP and not RAP. And also regardless if  it's open or dot1x SSID. Some clients are able to connect, others not. 

Regards

Tony

Hi Tony,

I do not have the issue with CAPs. These work just fine.

I'm just guessing, but I would assume this has something to do with the AP requiring connectivity to the individual members for clustering to work, which is obviously not possible using RAPs over the Internet.

Another AirHeads Community users was so kind to PM me after spending a day with support. They came to the conclusion that RAPs in combination with clustering is not supported yet, but is expected to work in 8.4 (no ETA yet).

Can somebody confirm? For me, it's not critical, so I'll wait it out.

ArubaOS 8.4 is out and clustering does work with RAPs.  Please see "Remote AP with cluster and NAT" here:  https://www.arubanetworks.com/techdocs/ArubaOS/8.4.x.x/Default.htm#ReleaseNotes/Features/Features8.4.x.htm%3FTocPath%3D_____2

---

@stevenjacobs wrote:

Hi Tony,

 

I do not have the issue with CAPs. These work just fine.

I'm just guessing, but I would assume this has something to do with the AP requiring connectivity to the individual members for clustering to work, which is obviously not possible using RAPs over the Internet.

 

Another AirHeads Community users was so kind to PM me after spending a day with support. They came to the conclusion that RAPs in combination with clustering is not supported yet, but is expected to work in 8.4 (no ETA yet).

 

Can somebody confirm? For me, it's not critical, so I'll wait it out.

---

Hi Colin,

Thanks for the info. This is pretty good news, so I went ahead and upgraded the clusters to 8.4.0.0.

The RAP could connect successfully before the upgrade, but now I get some new issues. It comes up, stays online for a couple of minutes and I see my SSIDs.

But after a couple of minutes, the RAP is shown to be down on the controller, and the WLAN LEDs change from green to amber. Similar to what you get when you dont add any vaps to the AP group. And it just sits there like that, not rebooting or anything.

The page you linked to is interesting, as I believe NAT may have something do do with it.

The incoming connection from the rap through the firewall is actually SNATted to the interface IP towards the controllers on the firewall. The reason is that the default route does not go back to the firewall, and this is a bit of a workaround. But the consequence is that the outer IP of the RAP changes to the interface IP of the firewall.

Would this cause an issue? And if so, is there a workaround?

Have you seen this page in the ArubaOS 8.4.0.0 user guide?