topic Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x in Wireless

Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

Mats Nilson — Mon, 05 Jul 2021 16:50:00 GMT

Hi collegues.

We have been struggling to get Philips Intellivue MX40 and X2 to stay connected without any drops on a shared SSID using WPA2 AES EAP with PKC/OKC.

Philips X3 models have no issues at all.

PMK rekey negotiations seems to be problematic with these types.

We did have similar issues with Spectralink earlier but these were resolved when they were exchanged to a later revision/version.

When I checked with collegues they all say that Philips X2/MX40 do not work on wireless EAP, and had to resort för PSK MAB.

Later I heard of another hospital that had implemented these with success, but when I checked the story it became evident that they were using 2702i APs. They had a snaller zone with 2802i APs, and there is didn't work!

Their settings were identical to ours except for the access points.

So it looks like the combination of Philips X2 and MX40 with Cisco 2802i running on AireOS 8.3.143.0 works badly causing disconnects and micro drops in the the telemetry data.

Anyone who has a working solution with above equipment?

Here's the overall settings on the SSID:

Network Name (SSID).............................. <SHARED-WLAN_X>
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Enabled
Network Admission Control
Client Profiling Status
    Radius Profiling ............................ Enabled
     DHCP ....................................... Enabled
     HTTP ....................................... Enabled
    Local Profiling ............................. Disabled
     DHCP ....................................... Disabled
     HTTP ....................................... Disabled
Radius-NAC State............................... Enabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum Clients Allowed.......................... Unlimited
Maximum number of Clients per AP Radio........... 200
ATF Policy....................................... 0
Number of Active Clients......................... 131
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 86400 seconds
User Idle Timeout................................ Disabled
Sleep Client..................................... disable
Sleep Client Timeout............................. 720 minutes
User Idle Threshold.............................. 70 Bytes
NAS-identifier................................... none
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ <Interface_name>
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
WLAN Layer2 ACL.................................. unconfigured
WLAN URL ACL..................................... unconfigured
mDNS Status...................................... Enabled
mDNS Profile Name................................ <mdns-profile-name>
DHCP Server...................................... Default
DHCP Address Assignment Required................. Enabled
Static IP client tunneling....................... Disabled
Tunnel Profile................................... Unconfigured
PMIPv6 Mobility Type............................. none
    PMIPv6 MAG Profile........................... Unconfigured
    PMIPv6 Default Realm......................... Unconfigured
    PMIPv6 NAI Type.............................. Hexadecimal
    PMIPv6 MAG location.......................... WLC
Quality of Service............................... Platinum
Per-SSID Rate Limits............................. Upstream      Downstream
Average Data Rate................................   0             0
Average Realtime Data Rate.......................   0             0
Burst Data Rate..................................   0             0
Burst Realtime Data Rate.........................   0             0
Per-Client Rate Limits........................... Upstream      Downstream
Average Data Rate................................   0             0
Average Realtime Data Rate.......................   0             0
Burst Data Rate..................................   0             0
Burst Realtime Data Rate.........................   0             0
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 1800 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
   Authentication................................ <ISE-Server-01> 1812 *
   Authentication................................ <ISE-Server-02> 1812 *
   Accounting.................................... <ISE-Server-01> 1813 *
   Accounting.................................... <ISE-Server-02> 1813 *
      Interim Update............................. Disabled
      Interim Update Interval.................... 0
      Framed IPv6 Acct AVP ...................... Prefix
   Dynamic Interface............................. Disabled
   Dynamic Interface Priority.................... wlan
Local EAP Authentication......................... Disabled
Radius NAI-Realm................................. Disabled
Mu-Mimo.......................................... Enabled
Security
   802.11 Authentication:........................ Open System
   FT Support.................................... Disabled
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Enabled
      WPA (SSN IE)............................... Disabled
      WPA2 (RSN IE).............................. Enabled
         TKIP Cipher............................. Disabled
         AES Cipher.............................. Enabled
         CCMP256 Cipher.......................... Disabled
         GCMP128 Cipher.......................... Disabled
         GCMP256 Cipher.......................... Disabled
      OSEN IE.................................... Disabled
      Auth Key Management
         802.1x.................................. Enabled
         PSK..................................... Disabled
         CCKM.................................... Disabled
         FT-1X(802.11r).......................... Disabled
         FT-PSK(802.11r)......................... Disabled
         PMF-1X(802.11w)......................... Disabled
         PMF-PSK(802.11w)........................ Disabled
         OSEN-1X................................. Disabled
         SUITEB-1X............................... Disabled
         SUITEB192-1X............................ Disabled
      FT Reassociation Timeout................... 20
      FT Over-The-DS mode........................ Disabled
      GTK Randomization.......................... Disabled
      SKC Cache Support.......................... Disabled
      CCKM TSF Tolerance......................... 1000
   Wi-Fi Direct policy configured................ xconnect-not-allowed
   EAP-Passthrough............................... Disabled
   CKIP ......................................... Disabled
   Web Based Authentication...................... Disabled
   Web Authentication Timeout.................... 300
   Web-Passthrough............................... Disabled
   Mac-auth-server............................... 0.0.0.0
   Web-portal-server............................. 0.0.0.0
   Conditional Web Redirect...................... Disabled
   Splash-Page Web Redirect...................... Disabled
   Auto Anchor................................... Disabled
   FlexConnect Local Switching................... Disabled
   FlexConnect Central Association............... Disabled
   flexconnect Central Dhcp Flag................. Disabled
   flexconnect nat-pat Flag...................... Disabled
   flexconnect Dns Override Flag................. Disabled
   flexconnect PPPoE pass-through................ Disabled
   flexconnect local-switching IP-source-guar.... Disabled
   FlexConnect Vlan based Central Switching ..... Disabled
   FlexConnect Local Authentication.............. Disabled
   FlexConnect Learn IP Address.................. Enabled
   Client MFP.................................... Optional
   PMF........................................... Disabled
   PMF Association Comeback Time................. 1
   PMF SA Query RetryTimeout..................... 200
   Tkip MIC Countermeasure Hold-down Timer....... 60
   Eap-params.................................... Disabled
AVC Visibilty.................................... Enabled
AVC Profile Name................................. None
Flow Monitor Name................................ NetFlow Monitor
Split Tunnel Configuration
    Split Tunnel................................. Disabled
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Disabled
802.11k Neighbor List Dual Band.................. Disabled
802.11v Directed Multicast Service............... Disabled
802.11v BSS Max Idle Service..................... Disabled
802.11v BSS Transition Service................... Disabled
802.11v BSS Transition Disassoc Imminent......... Disabled
802.11v BSS Transition Disassoc Timer............ 200
802.11v BSS Transition OpRoam Disassoc Timer..... 40
DMS DB is empty
Band Select...................................... Enabled
Load Balancing................................... Client-Count Based
Multicast Buffer................................. Disabled
Universal Ap Admin............................... Disabled
Broadcast Tagging................................ Disabled

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

Haydn Andrews — Mon, 11 Feb 2019 21:23:48 GMT

Just want to confirm that the MX40 actually associates and authenticates to the SSID and then experiences drop outs?

Are other devices also experiencing this?

Do these devices drop out when they are not moving, or is it on a roam?

Take it a wireless survey has been conducted to make sure that required data rates, SNR and RSSI is being achieved in the areas.

You have probably seen this but make sure you are meeting all the requirements of the install and service guide:

http://incenter.medical.philips.com/doclib/enc/fetch/2000/4504/577242/577243/577247/582636/582882/MX40_B.0_Service_Guide.pdf?nodeid=10668578&ver

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

patoberli — Wed, 13 Feb 2019 10:20:14 GMT

Can you please run a 'debug client mac-address' on the WLC via SSH while one is connected and then try to roam or wait for the PMK to happen?
To turn debug off, issue 'debug disable-all'.
I wonder what will happen.

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

Mats Nilson — Wed, 13 Feb 2019 11:15:52 GMT

Oh yes. The units do associate, but doing some debugging on the ISE gives more information since it seems the units fail to comply to PEAP standard. In the wlc debug client xxx the dropouts seems to coincide with EAP rekey auth and the reason was spot on when tracing the same client in ISE.

I suspect this behavior is caused by the clients trying to enforce SKC instead of OKC/PKC. SKC is not supported due to its limitations on a large network.

(Please note that we don't use 2.4GHz but utilize 5GHz instead. but the requirements for Philips Intellivue have been validated by Philips technicians.)

I will try and process the wlc debug on the same clients.

Sincere Regards

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

patoberli — Wed, 13 Feb 2019 14:24:03 GMT

Thanks, I think that is not needed in this case, because if the radius sends a "Reject", then the client must be dropped. I guess it's also time to involve Philips for this issue.

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

Mats Nilson — Thu, 14 Feb 2019 08:10:26 GMT

Yes, I have forwarded the debugs and traces to Philips to investigate.

In the debug I could find some code 17 from the access points that seemed out of scope since we use RF profiles that sets maximum clients to 200, but generates a trap when exceeding 12 clients per AP.

Feb 13 08:59:45.479 *apfMsConnTask_5 WLC/AP is sending an Association Response to the client with status code 17 = AP has reached the maximum supported clients

This must be a bug?

Because the maximum client threshold is set in the high density tab; at lest I thought so...

Default RRM trap threshold (above)

Altered trap threshold (above) is the updated RF profile setting, but sholdn't the high density tab/parameters set the maximum client cap?

May be this behavior is limited to 2802 access points?

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

patoberli — Thu, 14 Feb 2019 08:29:32 GMT

Not sure, but the Traps threshold is only generating a trap and I thought it should not inform the client about it, only the SNMP receiver. In any case, increase the limit to 50, just to be sure.
Also make sure it's correctly configured in the SSID under Advanced -> Maximum allowed clients. Set it to 0 to have no limit.

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

patoberli — Thu, 14 Feb 2019 08:31:18 GMT

Forgot one thing.

Make sure you have Client Load Balancing disabled on the SSID, or configure it differently under Wireless -> Advanced -> Load Balancing.

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

Mats Nilson — Thu, 14 Feb 2019 08:56:45 GMT

Yes, thats what I thought, but since this is the ONLY difference I can find that can cause this anomaly I played this safe and updated the trap setting. In the SSID advanced settings are ok:

If I check the radio performance settings on the access point I find it does follow the trap settings in the RF profile and not the high density settings or the the SSID settings!

I also notice the the globally controlled setting has been omitted, but it does follow the settings in the RF profile RRM traps.

Any idea why? No logic in this behavior...

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

patoberli — Thu, 14 Feb 2019 09:03:18 GMT

I don't use those profiles, never have. Only manually configured each setting.

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

Mats Nilson — Thu, 14 Feb 2019 09:10:30 GMT

Unless we disable the load balancing setting, what do you recommend for client window size and denial count?

Regards

/Mats

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

patoberli — Thu, 14 Feb 2019 09:18:44 GMT

I never liked load balancing, because it disrupts the client decision algorithm for roaming/attaching to an AP. In the end, it's always the client that decides when and where to roam and unless the driver of that client honors "weird" behavior of the AP, it will cause latency issues and sometimes no roamings at all.

Because of this, I always left this feature disabled, together with client band select.

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

Mats Nilson — Thu, 14 Feb 2019 09:47:43 GMT

Thanks.

I will consider doing this at the next change since any changes on the SSID will cause a short disruption.

In the meantime I have increased the window size to 10.

We do have Spectralink 2142 that after a firmware update works excellent with the same settings and infrastructure, but on a different site.

/Mats

I'll keep this thread updated for any progress regarding this issue.

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

patoberli — Thu, 14 Feb 2019 10:00:44 GMT

That reminds me, you have the SSID available on both frequencies (2.4 and 5 GHz), right? Otherwise you must disable Load Balancing if I remember correctly.

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

Mats Nilson — Thu, 14 Feb 2019 11:59:25 GMT

No, it's dual band, but load balancing shouldn't be impaired using single radio policy; you wasn't thinking of band-select?

I haven't heard this before. Are you sure?

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

patoberli — Thu, 14 Feb 2019 12:24:44 GMT

I think you're right and I mixed them up. In any case, here is the theory behind those two features: https://community.cisco.com/t5/wireless-mobility-documents/load-balancing-and-band-select-on-the-cisco-wireless-lan/ta-p/3128513#toc-hId--86706536

Re: Philips Intellivue MX40 and interoperability issues when using AP2802i and 802.1x

wififofum — Thu, 21 Mar 2019 23:51:40 GMT

Hi Mats,

Do a "sh pmk-cache <Philips_MAC_Address>" to see if the devices are showing up in the WLC's PMK cache. This should facilitate "fast-roam-back" as long as the device offers a PMKID in the Reassociation Request. How often is PEAP failing? Can you disable DHCP Required?