Wireless Access

I have a rap-2wg that is dropping the connect pretty much at the same time everyday - the users are required to reboot their Computers  to regain access to the wireless network  - I added the 2 people to debug and this is what the log is showing:

Feb 1 11:37:11 :501105: <NOTI> |stm| Deauth from sta: a0:88:b4:38:ce:fc: AP 172.16.6.26-00:24:6c:57:10:20-Toronto Reason Unspecified Failure
Feb 1 11:37:11 :501065: <DBUG> |stm| Sending STA a0:88:b4:38:ce:fc message to Auth and Mobility Unicast Encr WPA2 8021X AES Multicast Encr WPA2 8021X AES VLAN 0x2, wmm:0, rsn_cap:3c
Feb 1 11:37:11 :500511: <DBUG> |mobileip| Station a0:88:b4:38:ce:fc, 0.0.0.0: Received disassociation on ESSID: RPCorp Mobility service Off, HA Discovery on Association Off, Fastroaming Disabled, AP: Name Toronto Group RAP BSSID 00:24:6c:57:10:20, phy g, VLAN 2
Feb 1 11:37:11 :500010: <NOTI> |mobileip| Station a0:88:b4:38:ce:fc, 255.255.255.255: Mobility trail, on switch 10.0.150.10, VLAN 2, AP Toronto, RPCorp/00:24:6c:57:10:20/g
Feb 1 11:37:11 :522036: <INFO> |authmgr| MAC=a0:88:b4:38:ce:fc Station DN: BSSID=00:24:6c:57:10:20 ESSID=RPCorp VLAN=2 AP-name=Toronto
Feb 1 11:37:11 :501105: <NOTI> |AP Toronto@172.16.6.26 stm| Deauth from sta: a0:88:b4:38:ce:fc: AP 172.16.6.26-00:24:6c:57:10:20-Toronto Reason Unspecified Failure
Feb 1 11:37:11 :501000: <DBUG> |stm| Station a0:88:b4:38:ce:fc: Clearing state
Feb 1 11:37:11 :501114: <NOTI> |stm| Deauth from sta: a0:88:b4:38:ce:fc: AP 172.16.6.26-00:24:6c:57:10:20-Toronto Reason 255
Feb 1 11:37:11 :501044: <NOTI> |stm| Station a0:88:b4:38:ce:fc: No authentication found trying to de-authenticate to BSSID 00:24:6c:57:10:20 on AP Toronto
Feb 1 11:37:11 :501000: <DBUG> |AP Toronto@172.16.6.26 stm| Station a0:88:b4:38:ce:fc: Clearing state
Feb 1 11:37:11 :501106: <NOTI> |AP Toronto@172.16.6.26 stm| Deauth to sta: a0:88:b4:38:ce:fc: Ageout AP 172.16.6.26-00:24:6c:57:10:20-Toronto handle_sapcp
Feb 1 11:37:11 :501080: <NOTI> |AP Toronto@172.16.6.26 stm| Deauth to sta: a0:88:b4:38:ce:fc: Ageout AP 172.16.6.26-00:24:6c:57:10:20-Toronto Denied: AP Ageout
Feb 1 11:39:23 :501109: <NOTI> |AP Toronto@172.16.6.26 stm| Auth request: a0:88:b4:38:ce:fc: AP 172.16.6.26-00:24:6c:57:10:20-Toronto auth_alg 0
Feb 1 11:39:23 :501095: <NOTI> |stm| Assoc request @ 11:39:23.090135: a0:88:b4:38:ce:fc (SN 179): AP 172.16.6.26-00:24:6c:57:10:20-Toronto
Feb 1 11:39:23 :501100: <NOTI> |stm| Assoc success @ 11:39:23.093448: a0:88:b4:38:ce:fc: AP 172.16.6.26-00:24:6c:57:10:20-Toronto
Feb 1 11:39:23 :501065: <DBUG> |stm| Sending STA a0:88:b4:38:ce:fc message to Auth and Mobility Unicast Encr WPA2 8021X AES Multicast Encr WPA2 8021X AES VLAN 0x2, wmm:0, rsn_cap:3c
Feb 1 11:39:23 :522035: <INFO> |authmgr| MAC=a0:88:b4:38:ce:fc Station UP: BSSID=00:24:6c:57:10:20 ESSID=RPCorp VLAN=2 AP-name=Toronto
Feb 1 11:39:23 :522044: <INFO> |authmgr| MAC=a0:88:b4:38:ce:fc Station authenticate(start): method=8021x-User, role=RAPSplitTunneling/RAPSplitTunneling/, VLAN=2/2/0/0/0, Derivation=1/0, Value Pair=0
Feb 1 11:39:23 :522049: <INFO> |authmgr| MAC=a0:88:b4:38:ce:fc,IP=N/A User role updated, existing Role=RAPSplitTunneling/RAPSplitTunneling, new Role=RAPSplitTunneling/RAPSplitTunneling, reason=Station Authenticated with auth type: 11
Feb 1 11:39:23 :522029: <INFO> |authmgr| MAC=a0:88:b4:38:ce:fc Station authenticate: method=8021x-User, role=RAPSplitTunneling/RAPSplitTunneling/, VLAN=2/2/0/0/0, Derivation=1/0, Value Pair=0
Feb 1 11:39:23 :522044: <INFO> |authmgr| MAC=a0:88:b4:38:ce:fc Station authenticate(start): method=802.1x, role=RAPSplitTunneling/RAPSplitTunneling/, VLAN=2/2/0/0/0, Derivation=1/0, Value Pair=0
Feb 1 11:39:23 :522049: <INFO> |authmgr| MAC=a0:88:b4:38:ce:fc,IP=N/A User role updated, existing Role=RAPSplitTunneling/RAPSplitTunneling, new Role=RAPSplitTunneling/RAPSplitTunneling, reason=Station Authenticated with auth type: 4
Feb 1 11:39:23 :522029: <INFO> |authmgr| MAC=a0:88:b4:38:ce:fc Station authenticate: method=802.1x, role=RAPSplitTunneling/RAPSplitTunneling/, VLAN=2/2/0/0/0, Derivation=1/0, Value Pair=0
Feb 1 11:39:23 :522008: <NOTI> |authmgr| User Authentication Successful: username=RPCORP\sfeldman MAC=a0:88:b4:38:ce:fc IP=10.0.2.101 role=RAPSplitTunneling VLAN=2 AP=Toronto SSID=RPCorp AAA profile=RapSplitTunneling auth method=802.1x auth server=rpcodc02vm
Feb 1 11:39:23 :500511: <DBUG> |mobileip| Station a0:88:b4:38:ce:fc, 0.0.0.0: Received association on ESSID: RPCorp Mobility service Off, HA Discovery on Association Off, Fastroaming Disabled, AP: Name Toronto Group RAP BSSID 00:24:6c:57:10:20, phy g, VLAN 2
Feb 1 11:39:23 :500010: <NOTI> |mobileip| Station a0:88:b4:38:ce:fc, 0.0.0.0: Mobility trail, on switch 10.0.150.10, VLAN 2, AP Toronto, RPCorp/00:24:6c:57:10:20/g
Feb 1 11:39:23 :501093: <NOTI> |AP Toronto@172.16.6.26 stm| Auth success: a0:88:b4:38:ce:fc: AP 172.16.6.26-00:24:6c:57:10:20-Toronto
Feb 1 11:39:23 :501095: <NOTI> |AP Toronto@172.16.6.26 stm| Assoc request @ 11:39:22.974349: a0:88:b4:38:ce:fc (SN 179): AP 172.16.6.26-00:24:6c:57:10:20-Toronto
Feb 1 11:39:23 :501100: <NOTI> |AP Toronto@172.16.6.26 stm| Assoc success @ 11:39:22.986786: a0:88:b4:38:ce:fc: AP 172.16.6.26-00:24:6c:57:10:20-Toronto
Feb 1 11:39:24 :522038: <INFO> |authmgr| username=RPCORP\sfeldman MAC=a0:88:b4:38:ce:fc IP=0.0.0.0 Authentication result=Authentication Successful method=802.1x server=rpco-dc04
Feb 1 11:39:24 :522044: <INFO> |authmgr| MAC=a0:88:b4:38:ce:fc Station authenticate(start): method=8021x-User, role=RAPSplitTunneling//, VLAN=2/2/0/0/0, Derivation=1/0, Value Pair=1

I am not seeing any additional bootstrap on this device and I can only guess it's something on their network that is causing the issue - but thought I would ask the community if they had any thoughts.

thanks!

Lirria

Are they using their wired interfaces on the RAP2 for anything?

No - I actually have those pretty much disabled for security reasons - they all connect wirelessly.

Lirria

Okay, do you have "Drop Broadcasts and Multicast" on that Virtual AP?

That is currently disabled (unchecked)

Lirria

Do the WAN clients exist in a separate VLAN than the corporate clients?  How many clients, wired and wireless are in that VLAN?

The ap's live in their own space, the clients (wired and wireless) access the network thru the same IP range. We currently have 200 wired connections at the main location, and I am currently showing 202 wireless connections on the controller.

if it helps I have 27 aps at 12 locations world wide.

Lirria

Okay.

If you do not have "Drop Broadcast and Multicast" enabled, it is especially punishing for the WAN clients when a broadcast is propagated".  The drops you might see might correspond to a multicast or broadcast event that is being shared with your WAN clients.

If you do not have any applications that rely on Broadcasts or Multicast, I would consider enabling Broadcast and Multicast Filtering and Broadcast Filter ARP on the Virtual AP.

We shouldn't they are only using the aps for accessing the internal wiki, file shares and the like - I don't think there is any reason it should be a problem - we are only hearing about this from 1 office and it just started so that seems odd.

Lirria

Ah, so it is only one office, then?  Check the dashboard and see what the noise and interference is for that AP.  Airwave would give you historical information about that access point if it is enabled.  Also check to make sure they don't have a microwave that would knock all of those users off at the same time.

Noise floor : -110

interference: 5%

Hmm interesting thought - it does happen right at lunch time - I'll ask.

Lirria

No worries - I figured it was just me - I have too many projects that I'm working on and am feeling rather "scatter brained".

:smileyhappy:

Just heard back they are on the other side of the office from the microwave - double checking if it's a one story building or not though.

LIrria

Ok they are the top floor of a 10 story building - so probably not getting interferance from a microwave.

so Should I go ahead and make those changes or because it's only one location is it something else?

LIrria

You can try to wait and find out what else happens at that time, or if you do not use multicast/broadcast for your applications, you can turn those settings on.  It is up to you..

I think we'll wait - we have another office that is in shared space with similar - odd network issues provided by the same company so we are starting to think it's the providers network, plus they just recently made some network changes.

As always you totally rock!

Lirria

OK -

Feeling a little dense here (it's been a really long day already) So I apologize for needing further information - so do I need to check Dynamic Multicast Optimization, drop broadcast and multicast or convert broadcast ARP requests to unicast?

again sorry for being dense today.

Lirria

---

@Lirria wrote:

OK -

 

Feeling a little dense here (it's been a really long day already) So I apologize for needing further information - so do I need to check Dynamic Multicast Optimization, drop broadcast and multicast or convert broadcast ARP requests to unicast?

 

again sorry for being dense today.

 

Lirria

---

drop broadcast and multicast

convert broadcast ARP requests to unicast

Both on the Virtual AP profile of your WLAN.

I should have been more clear.  I apologize.