Wireless Access

Hello,

I need to investigate connectivity issue.

Wifi client connected to AP225 under Aruba7210-US sw. Version 6.3.1.9

Randomly, few times a week, the client loses connectivity to the network. It is not able to ping even default gateway. Ip address assigned, system shows that it is connected to WIFI., but ARP shows that ARP of default gateway is incomplete.

Then  after a couple of seconds connection restores automatically.

No issues for another wifi clients, nothing suspicious in logs.

Please, give me some commands to investigate the issue more deep.

 

What kind of client is this?  Are you using authentication?

Client is Ubuntu.

Authentification - .1x using machine cert.

Is the problem happening with other clients...

 

Only one client reported.

Maybe you can enable client-side wifi debugging in Linux to see what is happening.

 

On the controller side, you can enable debugging on the controller like this:

 

config t

logging level debugging user-debug <mac address of client>

 

 

When the problem happens, you type "show log user-debug 100" to see what happened at the time.  The controller debug along with the client-side debug should give us a clue what is happening.

 

We also have a suite of troubleshooting docs and related commands based on issues.  See here:

 

https://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Default.aspx?EntryId=17541

Hello,

 

Around a time when issues happened, I found following errors in logs:

|ids| AP: Block ACK DoS Attack: An AP detected a data frame which indicates a possible Block ACK DoS Attack. The frame from (mac address of the client) to (dest mac) (BSSID of my AP) on CHANNEL 100 with SNR 49) is outside the current sequence number window, and thus may be dropped.

 

The client is legitimate. How to avoid such error for the particular client?

---

@dzimin wrote:

Hello,

 

Around a time when issues happened, I found following errors in logs:

|ids| AP: Block ACK DoS Attack: An AP detected a data frame which indicates a possible Block ACK DoS Attack. The frame from (mac address of the client) to (dest mac) (BSSID of my AP) on CHANNEL 100 with SNR 49) is outside the current sequence number window, and thus may be dropped.

 

The client is legitimate. How to avoid such error for the particular client?

---

Those messages can be the result of false positives.

 

Linux drivers also can be less well maintained than Windows and other operating systems.  If you said that this problem occured with all of your clients, I would look to the system.  If it occurs with a single client, I would say to take another look at the client to see if there are any more up to date driver fixes.  Which client adapter is it?

 

Debug for client runs for a week, disconnection happens but nothing in the debug logs.

I noticed only gap in output. I.e disconnection happened at 12:14:40

Logs:

Nov 4 11:58:52 :522245: <DBUG> |authmgr| user_age() called for MAC xx:xx:xx:xx:xx:xx IP xxxx:xxxx:xxxx:xxxx:xxxx.
Nov 4 11:59:56 :522245: <DBUG> |authmgr| user_age() called for MAC xx:xx:xx:xx:xx:xx IP xxxx:xxxx:xxxx:xxxx:xxxx.
Nov 4 12:01:00 :522245: <DBUG> |authmgr| user_age() called for MAC xx:xx:xx:xx:xx:xx IP xxxx:xxxx:xxxx:xxxx:xxxx.
Nov 4 12:02:04 :522245: <DBUG> |authmgr| user_age() called for MAC xx:xx:xx:xx:xx:xx IP xxxx:xxxx:xxxx:xxxx:xxxx.
Nov 4 12:03:08 :522245: <DBUG> |authmgr| user_age() called for MAC xx:xx:xx:xx:xx:xx IP xxxx:xxxx:xxxx:xxxx:xxxx.
Nov 4 12:18:03 :522245: <DBUG> |authmgr| user_age() called for MAC xx:xx:xx:xx:xx:xx IP xxxx:xxxx:xxxx:xxxx:xxxx.
Nov 4 12:19:06 :522245: <DBUG> |authmgr| user_age() called for MAC xx:xx:xx:xx:xx:xx IP xxxx:xxxx:xxxx:xxxx:xxxx.

 

So DBUG user_age() messages appears each minute and then gap for 15 minutes

What is the output of "show ap client trail-info <mac address of client>"?

 

What is the output of "show ap client trail-info <mac address of client>"?

 

Nothing suspicious.

 

show ap client trail-info xx:xx:xx:xx:xx:xx

Client Trail Info
-----------------
MAC BSSID ESSID AP-name VLAN Deauth Reason Alert
--- ----- ----- ------- ---- ------------- -----
xx:xx:xx:xx:xx:xx xx:xx:xx:xx:xx:xx Test-A 10-13 251 STA has left and is deauthenticated STA has left and is deauthenticated

Deauth Reason
-------------
Reason Timestamp
------ ---------
STA has left and is deauthenticated Nov 4 13:56:55
STA has roamed to another AP Nov 4 06:52:38
STA has roamed to another AP Nov 4 05:55:21
STA has roamed to another AP Nov 4 05:55:11
STA has left and is deauthenticated Nov 3 13:55:30
STA has roamed to another AP Nov 3 10:55:09
STA has roamed to another AP Nov 3 10:55:00
STA has roamed to another AP Nov 3 09:45:47
STA has roamed to another AP Nov 3 09:45:36
STA has roamed to another AP Nov 3 08:00:56
Num Deauths:10

Alerts
------
Reason Timestamp
------ ---------
STA has left and is deauthenticated Nov 4 13:56:55
STA has roamed to another AP Nov 4 06:52:38
STA has roamed to another AP Nov 4 05:55:21
STA has roamed to another AP Nov 4 05:55:11
STA has left and is deauthenticated Nov 3 13:55:30
STA has roamed to another AP Nov 3 10:55:09
STA has roamed to another AP Nov 3 10:55:00
STA has roamed to another AP Nov 3 09:45:47
STA has roamed to another AP Nov 3 09:45:36
STA has roamed to another AP Nov 3 08:00:56
Num Alerts:10

Mobility Trail
--------------
BSSID ESSID AP-name Timestamp
----- ----- ------- ---------
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 4 13:56:55
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 4 06:52:38
xx:xx:xx:xx:xx:xx Test-A 10-01 Nov 4 06:52:38
xx:xx:xx:xx:xx:xx Test-A 10-01 Nov 4 05:55:21
xx:xx:xx:xx:xx:xx Test-A 10-03 Nov 4 05:55:21
xx:xx:xx:xx:xx:xx Test-A 10-03 Nov 4 05:55:11
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 4 05:55:11
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 4 05:19:23
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 3 13:55:30
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 3 10:55:09
Num Mobility Trails:10

show ap client trail-info xx:xx:xx:xx:xx:xx

Client Trail Info
-----------------
MAC BSSID ESSID AP-name VLAN Deauth Reason Alert
--- ----- ----- ------- ---- ------------- -----
xx:xx:xx:xx:xx:xx xx:xx:xx:xx:xx:xx Test-A 10-13 251 STA has left and is deauthenticated STA has left and is deauthenticated

Deauth Reason
-------------
Reason Timestamp
------ ---------
STA has left and is deauthenticated Nov 4 13:56:55
STA has roamed to another AP Nov 4 06:52:38
STA has roamed to another AP Nov 4 05:55:21
STA has roamed to another AP Nov 4 05:55:11
STA has left and is deauthenticated Nov 3 13:55:30
STA has roamed to another AP Nov 3 10:55:09
STA has roamed to another AP Nov 3 10:55:00
STA has roamed to another AP Nov 3 09:45:47
STA has roamed to another AP Nov 3 09:45:36
STA has roamed to another AP Nov 3 08:00:56
Num Deauths:10

Alerts
------
Reason Timestamp
------ ---------
STA has left and is deauthenticated Nov 4 13:56:55
STA has roamed to another AP Nov 4 06:52:38
STA has roamed to another AP Nov 4 05:55:21
STA has roamed to another AP Nov 4 05:55:11
STA has left and is deauthenticated Nov 3 13:55:30
STA has roamed to another AP Nov 3 10:55:09
STA has roamed to another AP Nov 3 10:55:00
STA has roamed to another AP Nov 3 09:45:47
STA has roamed to another AP Nov 3 09:45:36
STA has roamed to another AP Nov 3 08:00:56
Num Alerts:10

Mobility Trail
--------------
BSSID ESSID AP-name Timestamp
----- ----- ------- ---------
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 4 13:56:55
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 4 06:52:38
xx:xx:xx:xx:xx:xx Test-A 10-01 Nov 4 06:52:38
xx:xx:xx:xx:xx:xx Test-A 10-01 Nov 4 05:55:21
xx:xx:xx:xx:xx:xx Test-A 10-03 Nov 4 05:55:21
xx:xx:xx:xx:xx:xx Test-A 10-03 Nov 4 05:55:11
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 4 05:55:11
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 4 05:19:23
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 3 13:55:30
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 3 10:55:09
Num Mobility Trails:10

show ap client trail-info xx:xx:xx:xx:xx:xx

Client Trail Info
-----------------
MAC BSSID ESSID AP-name VLAN Deauth Reason Alert
--- ----- ----- ------- ---- ------------- -----
xx:xx:xx:xx:xx:xx xx:xx:xx:xx:xx:xx Test-A 10-13 251 STA has left and is deauthenticated STA has left and is deauthenticated

Deauth Reason
-------------
Reason Timestamp
------ ---------
STA has left and is deauthenticated Nov 4 13:56:55
STA has roamed to another AP Nov 4 06:52:38
STA has roamed to another AP Nov 4 05:55:21
STA has roamed to another AP Nov 4 05:55:11
STA has left and is deauthenticated Nov 3 13:55:30
STA has roamed to another AP Nov 3 10:55:09
STA has roamed to another AP Nov 3 10:55:00
STA has roamed to another AP Nov 3 09:45:47
STA has roamed to another AP Nov 3 09:45:36
STA has roamed to another AP Nov 3 08:00:56
Num Deauths:10

Alerts
------
Reason Timestamp
------ ---------
STA has left and is deauthenticated Nov 4 13:56:55
STA has roamed to another AP Nov 4 06:52:38
STA has roamed to another AP Nov 4 05:55:21
STA has roamed to another AP Nov 4 05:55:11
STA has left and is deauthenticated Nov 3 13:55:30
STA has roamed to another AP Nov 3 10:55:09
STA has roamed to another AP Nov 3 10:55:00
STA has roamed to another AP Nov 3 09:45:47
STA has roamed to another AP Nov 3 09:45:36
STA has roamed to another AP Nov 3 08:00:56
Num Alerts:10

 

 

Mobility Trail
--------------
BSSID ESSID AP-name Timestamp
----- ----- ------- ---------
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 4 13:56:55
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 4 06:52:38
xx:xx:xx:xx:xx:xx Test-A 10-01 Nov 4 06:52:38
xx:xx:xx:xx:xx:xx Test-A 10-01 Nov 4 05:55:21
xx:xx:xx:xx:xx:xx Test-A 10-03 Nov 4 05:55:21
xx:xx:xx:xx:xx:xx Test-A 10-03 Nov 4 05:55:11
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 4 05:55:11
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 4 05:19:23
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 3 13:55:30
xx:xx:xx:xx:xx:xx Test-A 10-13 Nov 3 10:55:09
Num Mobility Trails:10

If there was a problem, it does not look like it was controller-initiated. Some client side debugging might be in order.

Hi,

For last 2 weeks, one of our production office is having same issues with 

1) . Macbooks

2). Ubuntu Laptops

3). couple of windows laptop.

 

Have raised ticket, did a hell lot of remote session and tweaks, but the users are still facing this issue.

 

Logs are very identical to ones posted here by OP already.

Out of approx 1500 connected clients, the issue is with around 50 clients at the most.

Controller is 7205, IAP 325 is deployed on most floors and clients show no sign of virus infection on trend-micro.

 

How do I proceed with client side debugging???

Any leads ....

You should open a new thread for yourself with the number of access points, type of clients and how many SSIDs you are broadcasting.  This thread is three years old and much of the variables probably have changed and might not even be applicable.  Connectivity issues are typically generic in nature.