Wireless Access

Hi

We have issue with the Apple iOS 12.4 version. What happen was when the device associate to AP and receive an ip from the dhcp server then suddenly device will disconnect after that and in Clearpass all looks good because the authentication was accepted. We check the ap association the device was reassociated to AP but still we can't ping the ip of the device.

See below logs for the device that we trying to resolve.

(Aruba01) #show user-table | include 80:4a:14:ec:59:4d
10.243.34.225 80:4a:14:ec:59:4d wil20253 FCPD-Provision 00:00:31 802.1x 01-3RD-AP02 Wireless FCPD100/d8:c7:c8:a8:5e:98/a-HT aaa-FCPD100-EMEA-CPPM tunnel iPhone

(Aruba01) #ping 10.243.34.225
Press 'q' to abort.
Sending 5, 92-byte ICMP Echos to 10.243.34.225, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

Name bssid mac auth assoc aid l-int essid vlan-id tunnel-id phy assoc. time num assoc Flags Band steer moves (T/S) phy_cap
---- ----- --- ---- ----- --- ----- ----- ------- --------- --- ----------- --------- ----- ---------------------- -------
01-3RD-AP02 d8:c7:c8:a8:5e:98 80:4a:14:ec:59:4d y y 1 20 FCPD100 303 0x1042a a-HT-40sgi-2ss 14m:53s 2 WVAB 0/0 a-HT-40sgi-2ss-V

80:4a:14:ec:59:4d-d8:c7:c8:a8:5e:98 Stats
------------------------------------------
Parameter Value
--------- -----
Channel 116
Channel Frame Retry Rate(%) 0
Channel Frame Low Speed Rate(%) 0
Channel Frame Non Unicast Rate(%) 0
Channel Frame Fragmentation Rate(%) 0
Channel Frame Error Rate(%) 40
Channel Bandwidth Rate(kbps) 0
Channel Noise 93
Client Frame Retry Rate(%) 0
Client Frame Low Speed Rate(%) 0
Client Frame Non Unicast Rate(%) 0
Client Frame Fragmentation Rate(%) 0
Client Frame Receive Error Rate(%) 0
Client Bandwidth Rate(kbps) 0
Client Tx Packets 247
Client Rx Packets 1213
Client Tx Bytes 13069
Client Rx Bytes 64998
Client SNR 36
A2c_SM SeqNum, Old SeqNums 1016 0

(Aruba01) #show log all 100 | include 80:4a:14:ec:59:4d

Oct 2 09:35:28 stm[2386]: <501093> <NOTI> |AP FB02-G-AP02@10.27.129.7 stm| Auth success: 80:4a:14:ec:59:4d: AP 10.27.129.7-44:48:c1:b5:1b:91-FB02-G-AP02
Oct 2 09:35:28 stm[2386]: <501095> <NOTI> |AP FB02-G-AP02@10.27.129.7 stm| Assoc request @ 09:35:28.898516: 80:4a:14:ec:59:4d (SN 79): AP 10.27.129.7-44:48:c1:b5:1b:91-FB02-G-AP02
Oct 2 09:35:28 stm[2386]: <501218> <NOTI> |AP 02-G-AP02@10.27.129.7 stm| stm_sta_assign_vlan 18478: VLAN: sta 80:4a:14:ec:59:4d, STM assigns MAC based vlan_id 303
Oct 2 09:35:28 stm[4102]: <501218> <4102> <NOTI> |stm| stm_sta_assign_vlan 18365: VLAN: sta 80:4a:14:ec:59:4d, vlan_id not found from a previous association, looking in the bridge
Oct 2 09:35:28 stm[4102]: <501218> <4102> <NOTI> |stm| stm_sta_assign_vlan 18377: VLAN: sta 80:4a:14:ec:59:4d, bridge lookup vlan_id 303
Oct 2 09:35:28 stm[2386]: <501100> <NOTI> |AP 02-G-AP02@10.27.129.7 stm| Assoc success @ 09:35:28.900690: 80:4a:14:ec:59:4d: AP 10.27.129.7-44:48:c1:b5:1b:91-02-G-AP02
Oct 2 09:35:28 stm[4102]: <501218> <4102> <NOTI> |stm| stm_sta_assign_vlan 18431: VLAN: sta 80:4a:14:ec:59:4d, STM assigns bridge vlan_id 303
Oct 2 09:35:28 stm[4102]: <501100> <4102> <NOTI> |stm| Assoc success @ 09:35:28.904693: 80:4a:14:ec:59:4d: AP 10.27.129.7-44:48:c1:b5:1b:91-02-G-AP02
Oct 2 09:35:29 authmgr[4098]: <522038> <4098> <NOTI> |authmgr| username=wil20253 MAC=80:4a:14:ec:59:4d IP=0.0.0.0 Authentication result=Authentication Successful method=802.1x server=FBSPFCPM001
Oct 2 09:35:29 authmgr[4098]: <522008> <4098> <NOTI> |authmgr| User Authentication Successful: username=wil20253 MAC=80:4a:14:ec:59:4d IP=10.243.34.225 role=FCPD-Provision VLAN=303 AP=02-G-AP02 SSID=FCPD100 AAA profile=aaa-FCPD100-EMEA-CPPM auth method=802.1x auth server=FBSPFCPM001
Oct 2 09:35:30 dhcpdwrap[4144]: <202541> <4144> <DBUG> |dhcpdwrap| |dhcp| Received DHCP packet from Datpath, Flags 0x100040, Opcode 0x5a, Vlan 303, Ingress tunnel 928, Egress vlan 303, SMAC 80:4a:14:ec:59:4d
Oct 2 09:35:30 dhcpdwrap[4144]: <202536> <4144> <DBUG> |dhcpdwrap| |dhcp| Datapath vlan303: REQUEST 80:4a:14:ec:59:4d Transaction ID:0x1c79319d reqIP=10.243.34.225 Options 37:017903060f77fc 39:05dc 3d:01804a14ec594d 33:0076a700 0c:466c756f722d554b
Oct 2 09:35:30 dhcpdwrap[4144]: <202523> <4144> <DBUG> |dhcpdwrap| |dhcp| dhcprelay: mac=80:4a:14:ec:59:4d dev=eth1, length=300, from_port=68, op=1, giaddr=0.0.0.0, packet_vlan303
Oct 2 09:35:30 dhcpdwrap[4144]: <202533> <4144> <DBUG> |dhcpdwrap| |dhcp| Relayed: REQUEST server=10.51.16.65 giaddr=10.243.34.254 MAC=80:4a:14:ec:59:4d
Oct 2 09:35:30 dhcpdwrap[4144]: <202533> <4144> <DBUG> |dhcpdwrap| |dhcp| Relayed: REQUEST server=10.27.20.140 giaddr=10.243.34.254 MAC=80:4a:14:ec:59:4d
Oct 2 09:35:30 dhcpdwrap[4144]: <202533> <4144> <DBUG> |dhcpdwrap| |dhcp| Relayed: REQUEST server=10.50.19.140 giaddr=10.243.34.254 MAC=80:4a:14:ec:59:4d
Oct 2 09:35:30 dhcpdwrap[4144]: <202533> <4144> <DBUG> |dhcpdwrap| |dhcp| Relayed: REQUEST server=10.50.18.155 giaddr=10.243.34.254 MAC=80:4a:14:ec:59:4d
Oct 2 09:35:30 dhcpdwrap[4144]: <202533> <4144> <DBUG> |dhcpdwrap| |dhcp| Relayed: REQUEST server=10.27.20.21 giaddr=10.243.34.254 MAC=80:4a:14:ec:59:4d
Oct 2 09:35:30 dhcpdwrap[4144]: <202536> <4144> <DBUG> |dhcpdwrap| |dhcp| Datapath vlan10: REQUEST 80:4a:14:ec:59:4d Transaction ID:0x1c79319d reqIP=10.243.34.225 Options 37:017903060f77fc 39:05dc 3d:01804a14ec594d 33:0076a700 0c:466c756f722d554b
Oct 2 09:35:30 dhcpdwrap[4144]: <202523> <4144> <DBUG> |dhcpdwrap| |dhcp| dhcprelay: mac=80:4a:14:ec:59:4d dev=eth1, length=300, from_port=67, op=1, giaddr=10.243.34.254, packet_vlan10
Oct 2 09:35:30 dhcpdwrap[4144]: <202536> <4144> <DBUG> |dhcpdwrap| |dhcp| Datapath vlan10: REQUEST 80:4a:14:ec:59:4d Transaction ID:0x1c79319d reqIP=10.243.34.225 Options 37:017903060f77fc 39:05dc 3d:01804a14ec594d 33:0076a700 0c:466c756f722d554b
Oct 2 09:35:30 dhcpdwrap[4144]: <202523> <4144> <DBUG> |dhcpdwrap| |dhcp| dhcprelay: mac=80:4a:14:ec:59:4d dev=eth1, length=300, from_port=67, op=1, giaddr=10.243.34.254, packet_vlan10
Oct 2 09:35:30 dhcpdwrap[4144]: <202536> <4144> <DBUG> |dhcpdwrap| |dhcp| Datapath vlan10: REQUEST 80:4a:14:ec:59:4d Transaction ID:0x1c79319d reqIP=10.243.34.225 Options 37:017903060f77fc 39:05dc 3d:01804a14ec594d 33:0076a700 0c:466c756f722d554b
Oct 2 09:35:30 dhcpdwrap[4144]: <202523> <4144> <DBUG> |dhcpdwrap| |dhcp| dhcprelay: mac=80:4a:14:ec:59:4d dev=eth1, length=300, from_port=67, op=1, giaddr=10.243.34.254, packet_vlan10
Oct 2 09:35:30 dhcpdwrap[4144]: <202536> <4144> <DBUG> |dhcpdwrap| |dhcp| Datapath vlan10: REQUEST 80:4a:14:ec:59:4d Transaction ID:0x1c79319d reqIP=10.243.34.225 Options 37:017903060f77fc 39:05dc 3d:01804a14ec594d 33:0076a700 0c:466c756f722d554b
Oct 2 09:35:30 dhcpdwrap[4144]: <202523> <4144> <DBUG> |dhcpdwrap| |dhcp| dhcprelay: mac=80:4a:14:ec:59:4d dev=eth1, length=300, from_port=67, op=1, giaddr=10.243.34.254, packet_vlan10
Oct 2 09:35:30 dhcpdwrap[4144]: <202536> <4144> <DBUG> |dhcpdwrap| |dhcp| Datapath vlan10: REQUEST 80:4a:14:ec:59:4d Transaction ID:0x1c79319d reqIP=10.243.34.225 Options 37:017903060f77fc 39:05dc 3d:01804a14ec594d 33:0076a700 0c:466c756f722d554b
Oct 2 09:35:30 dhcpdwrap[4144]: <202523> <4144> <DBUG> |dhcpdwrap| |dhcp| dhcprelay: mac=80:4a:14:ec:59:4d dev=eth1, length=300, from_port=67, op=1, giaddr=10.243.34.254, packet_vlan10
Oct 2 09:35:30 dhcpdwrap[4144]: <202544> <4144> <DBUG> |dhcpdwrap| |dhcp| Datapath vlan10: ACK 80:4a:14:ec:59:4d Transaction ID:0x1c79319d clientIP=10.243.34.225
Oct 2 09:35:30 dhcpdwrap[4144]: <202523> <4144> <DBUG> |dhcpdwrap| |dhcp| dhcprelay: mac=80:4a:14:ec:59:4d dev=eth1, length=300, from_port=67, op=2, giaddr=10.243.34.254, packet_vlan303
Oct 2 09:35:30 dhcpdwrap[4144]: <202527> <4144> <DBUG> |dhcpdwrap| |dhcp| RelayToClient: ACK src=10.243.34.254 dest=10.243.34.225 client yiaddr=10.243.34.225 giaddr=10.243.34.254 MAC=80:4a:14:ec:59:4d
Oct 2 09:35:30 dhcpdwrap[4144]: <202544> <4144> <DBUG> |dhcpdwrap| |dhcp| Datapath vlan303: ACK 80:4a:14:ec:59:4d Transaction ID:0x1c79319d clientIP=10.243.34.225
Oct 2 09:35:30 dhcpdwrap[4144]: <202544> <4144> <DBUG> |dhcpdwrap| |dhcp| Datapath vlan10: ACK 80:4a:14:ec:59:4d Transaction ID:0x1c79319d clientIP=10.243.34.225
Oct 2 09:35:30 dhcpdwrap[4144]: <202523> <4144> <DBUG> |dhcpdwrap| |dhcp| dhcprelay: mac=80:4a:14:ec:59:4d dev=eth1, length=300, from_port=67, op=2, giaddr=10.243.34.254, packet_vlan303
Oct 2 09:35:30 dhcpdwrap[4144]: <202527> <4144> <DBUG> |dhcpdwrap| |dhcp| RelayToClient: ACK src=10.243.34.254 dest=10.243.34.225 client yiaddr=10.243.34.225 giaddr=10.243.34.254 MAC=80:4a:14:ec:59:4d
Oct 2 09:35:30 dhcpdwrap[4144]: <202544> <4144> <DBUG> |dhcpdwrap| |dhcp| Datapath vlan303: ACK 80:4a:14:ec:59:4d Transaction ID:0x1c79319d clientIP=10.243.34.225
Oct 2 09:35:30 stm[2386]: <501102> <NOTI> |AP FB02-G-AP02@10.27.129.7 stm| Disassoc from sta: 80:4a:14:ec:59:4d: AP 10.27.129.7-44:48:c1:b5:1b:91-FB02-G-AP02 Reason STA has left and is disassociated

Does the client have a mobility trail ?

show ap client trail-info <client-mac>

--Give Kudos: found something helpful, important, or cool? Click Kudos Star in a post.
--Problem Solved? Click "Accepted Solution" in a post.

Please see below.

(FLRFB01-Aruba01) #show ap client trail-info 80:4a:14:ec:59:4d

Client Trail Info
-----------------
MAC BSSID ESSID AP-name VLAN Deauth Reason Alert
--- ----- ----- ------- ---- ------------- -----
80:4a:14:ec:59:4d d8:c7:c8:a8:5e:98 FCPD100 FB01-3RD-AP02 303 Sapcp Ageout (internal ageout) STA has roamed to another AP

Deauth Reason
-------------
Reason Timestamp
------ ---------
Sapcp Ageout (internal ageout) Oct 2 10:43:03
AAA Deauthenticate Oct 2 10:19:13
Disassociated; Auth frame from STA that was already associated Oct 2 09:35:28
Disassociated; Auth frame from STA that was already associated Oct 2 09:33:11
AAA Deauthenticate Oct 2 09:30:13
Sapcp Ageout (internal ageout) Oct 2 09:29:14
Disconnect User Oct 2 09:09:49
Num Deauths:7

Alerts
------
Reason Timestamp
------ ---------
STA has roamed to another AP Oct 2 09:48:01
STA has roamed to another AP Oct 2 09:34:06
STA has roamed to another AP Oct 2 09:10:25
Num Alerts:3

Mobility Trail
--------------
BSSID ESSID AP-name VLAN Timestamp
----- ----- ------- ---- ---------
d8:c7:c8:a8:5e:98 FCPD100 FB01-3RD-AP02 303 Oct 2 10:43:03
d8:c7:c8:a8:5e:98 FCPD100 FB01-3RD-AP02 303 Oct 2 10:26:22
d8:c7:c8:a8:5e:98 FCPD100 FB01-3RD-AP02 0 Oct 2 10:26:22
d8:c7:c8:a8:5e:98 FCPD100 FB01-3RD-AP02 303 Oct 2 10:26:10
d8:c7:c8:a8:5e:98 FCPD100 FB01-3RD-AP02 0 Oct 2 10:26:10
d8:c7:c8:a8:5e:98 FCPD100 FB01-3RD-AP02 303 Oct 2 10:25:43
d8:c7:c8:a8:5e:98 FCPD100 FB01-3RD-AP02 0 Oct 2 10:25:43
d8:c7:c8:a8:5e:98 FCPD100 FB01-3RD-AP02 303 Oct 2 10:24:13
d8:c7:c8:a8:5e:98 FCPD100 FB01-3RD-AP02 0 Oct 2 10:24:13
d8:c7:c8:a8:5e:98 FCPD100 FB01-3RD-AP02 303 Oct 2 10:20:27
Num Mobility Trails:10

Is the client successfully authenticating?

There are two deauth entries with aaa deauthenticate. Is this intentionally configured?

There are SAPCP ageouts (basically means that if for a set period of time there is no transaction of messages between the AP and client , the client is aged out). This can be configured in the SSID-Profile (station ageout time) in case the authentication process of the client is taking longer than the configured ageout time.

Although the messages say that the client has roamed to another AP, the mobility trail indicates that the client is trying to connect to the same AP. 

What is the behaviour when you try to connect to an open SSID?

--Give Kudos: found something helpful, important, or cool? Click Kudos Star in a post.
--Problem Solved? Click "Accepted Solution" in a post.

Yes client device was authenticated 

Then deauth that was happen when the device is authenticated and got an ip it will immediately deauth and aaa deauth was not configured in our controller. 

I then for the roamed I think the user is walking around the office during that time that roamed to other ap. 

We tried the user to connect to our open SSID and client device did not drop so far.