Wireless Access

Frequent Contributor I

Client Match question

I've a user who is reporting that he's continually having to re-log into the network. Upon investigation it looks like he is equi-distant from two APs. Airwave is showing that he is quite often being unstuck, moving from one close by AP to another. (see attached). 


I understand that ClientMatch sends a de-auth to the client, and therefore I beieve the user would have to re-authenticate via portal or 802.1x once one of these events happened? Therefore, clientmatch is a possible cause of the reported behaviour?


(I've yet to visit site to check the actual RF side of things in the area. )

Frequent Contributor II

Re: Client Match question

Try upgrading and use the OCK.


Support for Client Roaming Based on Opportunistic Key Caching

Instant also supports opportunistic key caching (OKC) based roaming. In the OKC based roaming, the AP stores a
cached pairwise master key (PMK) for each client, which is derived from last 802.1X authentication completed by
the client in the network. By default, the 802.1X authentication profile enables a cached PMK, which is used when a
client roams to a new AP. The cached PMK is used when a client roams to a new AP. This allows faster roaming of
clients between the IAPs in a cluster, without requiring a complete 802.1X authentication.

If you found my post helpful, please give kudos!
Aruba Employee

Re: Client Match question

some usefull options to debug client-match



(config) #logging level debugging arm-user-debug <mac>

(config) #show ap virtual-beacon-report client-mac <mac>

(config) #show log arm-user-debug all

(config) #show ap client trail-info <client-mac>



and you can adjust  Client Match settings if needed



Guru Elite

Re: Client Match question

Be careful turning on OKC. There are clients that don't support it which
can make roaming even worse for them.

| Tim Cappalli | Aruba Security | @timcappalli | timcappalli.me |

NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.
Frequent Contributor I

Re: Client Match question

Thanks, I'll delve into the debug to see if I can find out what's going on (assuming I can get the client online). 


Good to see that the client match settings are very configurable. lots of room for experimentation :)



Search Airheads
Showing results for 
Search instead for 
Did you mean: