Wireless Access

I have a weird problem that is specific to my phone (Galaxy S6 (SM-G920A)) and to Access points for a specific Guest Portal (with RADIUS Server Authentication).

I am wondering if it is because my phone may not be capable fo fast roaming  802.11r and my phone is not on the supported list?

https://support.samsungknox.com/hc/en-us/articles/115013403768-Enhanced-Roaming-Algorithm

Question1: How can I tell if fast roaming is enabled on the Aruba network?

How can I tell if that is the problem?  Other Android phones are working just fine; but, my phone is verison 7.0 and theirs is runnign version 9.0.  Also other GUEST portal SSID (ARUBA) using an internal user account/password roams just fine.  Iphones and Ipads and other TAblets work fine, just my phone is not roaming between APs on 1 specific Guest SSID.

Why?

This is interesting:

https://community.arubanetworks.com/t5/Wireless-Access/Client-IP-DHCP-Issue-Re-Authentication-while-roaming/td-p/293705

How can I check this?

Using the above mentioned link, I realized that I needed to add a post-authentication user security rule for the BYOD Guest post authenticatrion access.

I created an any source to any destinatin rule to alow DHCP (post authentication user role)and that worked.  My Android Cell phone was able to roam from AP to AP and maintain its IP address and connection to the WLAN.

However, when I tried to be stingy and only allow Any source from the 2 Controllers only and allow DHCP that did not work.  We had the same problem as before.

I think the Aruba Access Points must play a factor in the authentication with RADIUS Servers and captive portal authentication.  So I added the Any source to Any destination to allow DHCP and made that a priority with all of the other ACL rules in that post-auth role.  Then we were functional again.

So, it appears that I needed to allow DHCP from any source/desination for a few Android devices to remain connected between ap's. This is not necessary for the other SSIDs taht do nto use captive portal authentication.

I did want to allow only the required services to be used on the GUEST access; but, this is weird that only a few Android devices were affected.  Does anyone have any comments on this situation?

I found my own answer. Please close this question with soluton discovered.

I needed to add a firewall / ACL rule to teh Post - Authentication Role for Any source to Any destination to allow dhcp as a priority 1.