Missing Subentmask and Gateway in Client Details

[MICHAEL SCHROEDER]

Hi All,

we see the Effect that from time to time an associated WiFi Client lost its Subnetmask and Gateway Information. Take a look:

 

The Client is still connected. SSID is configured with .1x and AAA Override. WLC Code is 8.8.

Does anyone know under which Circumstances this could happen?

BR, Michael

[Scott Fella]

Is the client on the RUN state? If not, then the device is probably failing 802.1x. If it's in the run state, then maybe a dhcp issue.

[MICHAEL SCHROEDER]

Yes, the Client is still in RUN State. .1x is OK, and by tracing DHCP Packets everything seems also to be OK. The difficult thing is, that we talk about a Campus with 4000 AP and 8000+ Clients, and the issue is coming randomly, so its hard to catch ...

// Mike

[patoberli]

You run 8.8 in such a large environment? That's brave...
I also suggest to increase session timeout a LOT, or decrease DHCP lease validity to maximum the near double of session timeout. That way the client must wake up, refresh its lease and can then go to sleep again.

[MICHAEL SCHROEDER]

Hi, 8.8 was not my Release of Choice, but due to some Bugs we had to use it. OK, you all assume a relation between EAP Session Timeout of 30min, DHCP Lease Time of 1 Day and the Clients loss of Gateway and Subnetmask (its marked as "unavailable" into WLC Client Detail) but keeping its IP Address? So I will Discuss to Streamline all Parameters with my Customer.
Thank you all, if there are other Ideas, I will wait for it!
BR, Michael

[patoberli]

The client will keep it's ip address, if it's in sleep mode and getting deleted because of the session timeout. The client doesn't know it was deleted, because it was sleeping.

This is just one scenario, where your behavior could happen.

Also make sure that "DHCP required" is not enabled on the SSID, this could also cause issues like the one you are seeing (if the client is moved while in standby and after wake up on a new WLC), for example.

[Scott Fella]

Michael,

You are the expert and sometimes what the customer wants isn’t the best way. Call out the risk and the customer either goes with your recommendations or signs off on the risk.

When troubleshooting a large environment, you need to identify the devices affected, see if there is any thing unique about the devices. Drivers, NIC, OS versions, location, AP the device is associated to, etc. You should also try to replicate the issue with an affected device. If the device is in sleep/hibernate, and when the user wakes up the device, the device does a re-auth and functions, might not have any user experience impact. With this type of data, you and the customer can decide next steps.

[ajc]

How is your DHCP lease time configured? How is your SSID Advance Tab --- > DHCP Addr Assignment configured? How is your session-timeout configured for the specific SSID?

[MICHAEL SCHROEDER]

Hi, DHCP Lease is 1 Day (Customer Decision), DHCP Address is not Required, since some Clients (WGB) are still connected with Static IP. Session Timeout is 1800sec and - via AAA Override - 68400sec for VoIP Clients. The Corporate SSID is a single SSID approach, there is one .1x SSID and one Open /wo Auth and 3rd Party Captive Portal. Only Corporate Clients (ca 1800 Clients) are affected.

BR, Michael

[ajc]

Is that 30 min session-timeout for the corporative clients? I experienced a similar issue and I realized based on Cisco ISE logs that my disconnection happened every 8 hours (session-timeout). I suspect this timer is causing you this intermittent and random issue.

[MICHAEL SCHROEDER]

Yes, 30min Session Timeout are the default for the Corporate SSID, for VoWLAN Clients its 68400 per AAA Override. What were your  Settings?

[Scott Fella]

Well that might be one reason you see that. The client might be in sleep mode and doesn’t want to request dhcp and thus you see what you do. 30 minutes is too low and I’m not a fan of lowering dhcp lease times especially if the reason is because they don’t want to increase the subnet.  I can see clients having issues if you have WGB’s and or specific devices with old NIC or drivers. 

[MICHAEL SCHROEDER]

OK, thanks to everyone who invests Time on my Issue. BR, Michael