topic Re: Slow downloads with WPA 802.1x in Wireless

Slow downloads with WPA 802.1x

Steve Lattray — Mon, 05 Jul 2021 15:08:04 GMT

I am noticing slow downloads with users connected to my secured SSID. User on the Guest SSID (open) do not see the issue. Downloads are ~17mbs uploads are +50 mbs. I am testing using iperf server on same Vlan as the access point. Any help would be appreciated.

Topology is 5520 - 6509 - 3750 - 2702i

Cisco 5520 running 8.2.160.0

Cisco 2702i access point

Configuration:

security = WPA+WPA2, AES, 802.1x

QOS = Platinum

Multicast direct enabled

WMM enabled

MSS adjust 1250

Re: Slow downloads with WPA 802.1x

Flavio Miranda — Fri, 19 Jan 2018 14:01:53 GMT

Hi,

Does those SSIDs use different interfaces?

-If I helped you somehow, please, rate it as useful.-

Re: Slow downloads with WPA 802.1x

Steve Lattray — Fri, 19 Jan 2018 15:53:50 GMT

The guest SSID uses Management interface(Vlan250) and the other uses interface group called ejunplugged (G) (Vlan 180 and 252).

interface Port-channel250
description nc93-s-wlas1a_xxx.xxx.xxx.xxx_T1/1/1-2_POR2_VLAN250
switchport
switchport mode trunk
switchport trunk allowed vlan 180,184,250,252,350
service-policy input INGRESS-CLASSIFIER

interface Vlan250
description WLAN_Mgmt
ip address xxx.xxx.xxx.xxx 255.255.255.128
no ip redirects
no ip unreachables
ip directed-broadcast
ip pim dr-priority 10
ip pim sparse-mode
standby version 2
standby 250 ip xxx.xxx.xxx.xxx
standby 250 priority 120
standby 250 preempt delay minimum 120

interface Vlan180
description ejclients-180
ip address xxx.xxx.xxx.xxx 255.255.252.0
ip access-group Workstation_ACL in
ip helper-address xxx.xxx.xxx.xxx
ip helper-address xxx.xxx.xxx.xxx
ip helper-address xxx.xxx.xxx.xxx
ip helper-address xxx.xxx.xxx.xxx
no ip redirects
no ip unreachables
ip directed-broadcast
ip pim dr-priority 10
ip pim sparse-mode
standby version 2
standby 180 ip xxx.xxx.xxx.xxx
standby 180 priority 120
standby 180 preempt delay minimum 120

interface Vlan252
description ejclients-252
ip address xxx.xxx.xxx.xxx 255.255.252.0
ip access-group Workstation_ACL in
ip helper-address xxx.xxx.xxx.xxx
ip helper-address xxx.xxx.xxx.xxx
ip helper-address xxx.xxx.xxx.xxx
ip helper-address xxx.xxx.xxx.xxx
no ip redirects
no ip unreachables
ip directed-broadcast
ip pim dr-priority 10
ip pim sparse-mode
standby version 2
standby 252 ip xxx.xxx.xxx.xxx
standby 252 priority 120
standby 252 preempt delay minimum 120

Re: Slow downloads with WPA 802.1x

Scott Fella — Fri, 19 Jan 2018 15:59:31 GMT

Can you post your iper results. Test on the same user subnet, not across later 3.

Example:

iperf3 server - vlan 100

iperf3 client - vlan 100

Test both ways as you can use the -R flag if you are using commands

Test on 2.4ghz and then on 5ghz

Re: Slow downloads with WPA 802.1x

Steve Lattray — Fri, 19 Jan 2018 16:23:47 GMT

The controller and 6509 are in a remote datacenter. I only have physical access to the closet switch. below are the tests I was able to perform.

wired to wired - Both laptops connected to the closet switch (Vlan 225) = 90 up 90 down

wired to wireless (secured SSID) - iperf server wired to closet switch(Vlan 225) and client connected to wireless = 59 up 17 down

wired to wireless (UN-secured SSID) - iperf server wired to closet switch (Vlan 225) and client connected to wireless = 52 up 61 down

I get the same result on 2.4 and 5 Ghz. (802.11an and 802.11bn)

Re: Slow downloads with WPA 802.1x

Saravanan Lakshmanan — Fri, 19 Jan 2018 17:01:02 GMT

assuming the same client were used for testing on open and wpa ssids.
are per-user/per-wlan band-width contracts enabled/enforced on WLAN in question or on the wired side.
try testing with QoS besteffort/silver.
it also depends on Client's RSSI, capability, type of traffic in play.

Re: Slow downloads with WPA 802.1x

Flavio Miranda — Fri, 19 Jan 2018 17:27:41 GMT

Your iperf test looks very similar for both.

As you are using different interfaces for each SSID, I´d follow on this direction for now. Start by ping from using vlan as source. I mean, basic connectivity.

After that, thy to figure out if there´s some content filter on the secure SSID or any bandwidth control somewhere.

-If I helped you somehow, please, rate it as useful.-

Re: Slow downloads with WPA 802.1x

Scott Fella — Fri, 19 Jan 2018 17:32:07 GMT

What I would do is test on both 2.4ghz and 5ghz to see if there is any difference. Then I would create a test SSID that is open using the same subnet as your secure SSID. This way you can determine if it’s a WPA issue or maybe the network.

Re: Slow downloads with WPA 802.1x

Steve Lattray — Fri, 19 Jan 2018 17:48:46 GMT

Thanks for the reply. RSSI is ~-50 ( the AP I am testing with is 5 feet away).

Most traffic is slow. internet downloads, files from the filer, iperf tests, etc.). This is not a single case. The building is 9 stories tall, has 167 access points, and we see the problem everywhere on 2.4 and 5Ghz.

I don't believe its an RF issue because the guest SSID works fine. Seems to be related to WPS, 802.1x, QOS, or multicast. Those are the main differences between the SSID's

Re: Slow downloads with WPA 802.1x

Steve Lattray — Fri, 19 Jan 2018 18:07:51 GMT

The physical interfaces for both SSID are the same. I'm not seeing any errors. There are no filters or bandwidth control configured

Re: Slow downloads with WPA 802.1x

Steve Lattray — Fri, 19 Jan 2018 18:10:47 GMT

Test on 2.4 and 5 are provide the same results. Since this is a production device I am unable to create a new SSID at this time.

Re: Slow downloads with WPA 802.1x

Flavio Miranda — Fri, 19 Jan 2018 18:11:12 GMT

That´s good. But what about the Interface vlan? They follow the same path, they have the same link as egress ?

As I said, I´d take a look on possible content filter or bandwidth control.

-If I helped you somehow, please, rate it as useful.-

Re: Slow downloads with WPA 802.1x

Scott Fella — Fri, 19 Jan 2018 18:46:50 GMT

Okay, but remember, we are now trying to eliminate if its an issue with using WPA or possible network causing the slowness.

Re: Slow downloads with WPA 802.1x

Steve Lattray — Sun, 28 Jan 2018 22:18:31 GMT

We did a lot of testing last week. We believe the slow response is from the distribution switches are remarking packet to DSCP 46. The odd part is this remarking to 46 does not occur on all access points.