Vlan question about WIfi

jesse.garcia11 · ‎08-13-2021

I am in a production environment with several vlan/wifi SSIDs. But my campus just went one-to-one with Chromebook devices and the production network that they are connected to, is the same vlan across the network. So we have 6 sites, all same Vlan. My question is will this cause a bottle neck? Before covid, we never had any issues. Today, first day back with all students having their own Chromebook so obviously double maybe triple typical device amount, that particular SSID took a drastic decrease in speed, sometimes not even auth to the network. It seemed to get stuck. Now we were able to narrow it down to that particular SSID/VLAN, by connecting the hung ones to hotspots and our guest network and normal network function was restored on those. Switch back to production and went back to be extremly laggy. It seems that DHCP has handed out over 7K IPs thus far and that is not all of them. Is that too much for one VLAN? My theory is that they are bottlenecking somewhere or taxing one resource due to too many devices but I am just not sure where. Any help or guidance on where to look will be extremely helpful.

We use a cisco WLC blade attached to our core in the MDF, and each site has a dist that is routing through this core at the MDF. We are also using cisco ASA

Georg Pauwen · ‎08-13-2021

Hello,

not sure if I fully understand your topology, buy 7K IP addresses in one single Vlan seems very excessive, especially if the broadcast traffic travels to all sites. Do you have a diagram of your topology, showing how exactly the sites are connected ?

jesse.garcia11 · ‎08-13-2021

Thank you for your reply!. Yes I think it is too. Since the other vlan/ssids were not being bogged out at all. But how can I test this? With the broadcast traffic? I am searching now online for some tools. I dont have a current diagram of the prod environment, I just know it is a hub and spoke, with each site fiber coming into our 6509 here at the main site. This is where all outgoing traffic gets routed to. But each site has the prod wifi and is tagged the same at each edge switch at each site with the same VLAN ID. It is just a different WLAN ID in the WISM. And again all was fine up until today. when we had a bombardment of devices connecting

Joseph W. Doherty · ‎08-13-2021

Like Georg, your topology isn't fully clear to me either. However, are you saying a wireless host at some specific location, using the "production" SSID has various performance issues but if you switch that wireless host to another SSID (assuming it's using the same WAP) it works fine?

If so, if would seem you do have some kind of bottleneck for your production SSID.

It has been years since I've dealt with wireless. Wireless does have its own gotchas, many different from wired LAN networks. (For example, I recall broadcasts aren't an issue for them like for wired networks. [Which I mention because Georg mentioned broadcasts as a potential issue for your large number of wireless hosts.])

Normally, bottlenecks, for high usage, occurs first on the wireless side but if you don't see the same performance issue just switching to another SSID that would, I think, discount some of that, but perhaps not all of it.

I'm assuming different SSIDs, on the same WAP, would share the same wireless bandwidth channel, but some quick reading seems to imply that may not always be the case.(?) If not, switching a wireless client to another SSID, that's not busy, would certainly improve that client's wireless performance.

By default, traffic to the WAP, I believe (?), does not treat different SSID hosts differently, again assuming different SSIDs are sharing the same physical wireless channel.

I'm less sure about traffic from WAP to wireless hosts. If WAP has transmission queue, per SSID, and does something like round robin between them, then a less utilized SSID could have its traffic jump ahead of a busy SSID. This would make a difference even if multiple SSIDs share the same wireless channel.

If there is a difference between WAP ingress and egress, the latter would be usually more important as most user hosts tend to pull more data then they push.

I have a hazy recollection that a WiSM or WLC often have some form of Etherchannel. If so, I'm wondering whether a really busy wireless LAN, either to the wired LAN or to the wireless LAN, might use only one Etherchannel "link" for a single wireless LAN.

jesse.garcia11 · ‎08-13-2021

@Joseph W. Doherty wrote:
Like Georg, your topology isn't fully clear to me either. However, are you saying a wireless host at some specific location, using the "production" SSID has various performance issues but if you switch that wireless host to another SSID (assuming it's using the same WAP) it works fine?
Yes it does but it was more than one host. Let me see if I can specify deeper.
Each site has its own SSID. So Highschool A has "A Prod Network" and Highschool B has SSID "B prod Network" and so on.....however, they all fall under the same VLAN in the switches. So as each highschool sends traffic to "Main Site" even though it is different SSIDs they come in tagged as the same traffic.VLAN 60. Each new chromebook has been put onto this SSID by us in tech services based on each site. The students or staff do not have the passwords, so we can limit who is on there. In our dhcp Scope we have them as different subnets so they do not pool from the same dhcp scope. My theory was that once in the LAN, the traffic is getting bottlenecked somewhere. Since each site has two guest SSID's as well that and when certain machines that came in having issues would connect and be fully functional, we know that it is not an AP issue because each AP outputs the same SSIDs relative per site. I hope this helps. So to sum it up, various students using chromebooks on "A prod Network", "B prod Network"etc(different physical campuses) were getting timed out of certain websites, not able to log in to chromebooks, laptops were experiencing this strong 'throttle' as well. When a student exibiting said issue it was always on the 'prod SSIDs'(same vlan 60 across district), we would switch them to a guest ssid and the issues went away. full network speeds were restored.

If so, if would seem you do have some kind of bottleneck for your production SSID.
It has been years since I've dealt with wireless. Wireless does have its own gotchas, many different from wired LAN networks. (For example, I recall broadcasts aren't an issue for them like for wired networks. [Which I mention because Georg mentioned broadcasts as a potential issue for your large number of wireless hosts.])
Normally, bottlenecks, for high usage, occurs first on the wireless side but if you don't see the same performance issue just switching to another SSID that would, I think, discount some of that, but perhaps not all of it.
I'm assuming different SSIDs, on the same WAP, would share the same wireless bandwidth channel, but some quick reading seems to imply that may not always be the case.(?) If not, switching a wireless client to another SSID, that's not busy, would certainly improve that client's wireless performance.
Yes which is what threw us off. And I am thinking it is an issue on the switch side. I am going to try and troubleshoot internal vs outside traffic, and go from there.
By default, traffic to the WAP, I believe (?), does not treat different SSID hosts differently, again assuming different SSIDs are sharing the same physical wireless channel.
I'm less sure about traffic from WAP to wireless hosts. If WAP has transmission queue, per SSID, and does something like round robin between them, then a less utilized SSID could have its traffic jump ahead of a busy SSID. This would make a difference even if multiple SSIDs share the same wireless channel.
If there is a difference between WAP ingress and egress, the latter would be usually more important as most user hosts tend to pull more data then they push.
I have a hazy recollection that a WiSM or WLC often have some form of Etherchannel. If so, I'm wondering whether a really busy wireless LAN, either to the wired LAN or to the wireless LAN, might use only one Etherchannel "link" for a single wireless LAN.

Thank you very much for your reply.

Joseph W. Doherty · ‎08-14-2021

Hmm, BTW, I assume your "prod" SSID(s), using VLAN 60, have different wireless parameters (e.g. encryption?) than a guest SSID. If so, you're also, somewhat, comparing apples to oranges. I.e. Issue only with Chromebooks because if perhaps your Chromebooks might not "like" something setup for your "prod" SSID(s).

Oh, BTW, I recall (?) (years ago when I revamped some of our wireless controller parameters, in a large [100K users] Enterprise environment) there were a few parameters that can impact performance, such as setting some value for MTU to allow for the overhead of the WAP to wireless controller tunnels.

Leo Laohoo · ‎08-13-2021

I manage over 100 school sites and we have no problem scaling. I have several AP3700 that have >60 wireless clients. Daily.

What I want to know is the state of the LAN switches and the size of the WAN link.

jesse.garcia11 · ‎08-13-2021

Hi, I think that is what i would like to know as well, but I don't know how to test. Are all of your devices coming in tagged on the same vlan? Each of my high schools have their own respective SSID that is where the chromebooks are connected to. But in the LAN side, they are coming in all on the same traffic. So on each edge switch, the VLAN 60 is the same across the district, just specific description to each site.

@wan link is currently each site(HS) has a 5GB fiber link to the central hub(district office), where the ASA is with 40gb to the ISP

Leo Laohoo · ‎08-13-2021

5 Gbps WAN is plenty.

What about the LAN? What backbone link speed?

What is the AP ethernet port negotiating to?

Please explain what the main issue is.

jesse.garcia11 · ‎08-13-2021

I apologize if i dont understand completely. Each site has a 5GB link to core. As for each LAN link I will have to find out when i go to work as I know it was just upgraded before I got there last month. The main issue is the wireless devices on one SSID at each site were experiencing the same network issues, which was frequent timeouts, certain chromebook devices would not get to their login screens. showing a no network available issue, laptops on the same ssids were having issues loading pages. Like an extreme throttle issue. To me, since this was the first time that all these devices were connected at one, there is a throttle somewhere, and I am having a hard time figuring out where. I dont think it is the access points since the other guest ssids at each site worked fine on the same reported devices. Each device is on on the ssid will be coming in as the same VLAN district wide(6 sites and over 7k devices). Is that too much for a VLAN to handle? since they will all be heading in the same direction out their respective distribution switches up to the core tagged as the same traffic on all sites causing a bottleneck there? Should each site have its own vlan?

Leo Laohoo · ‎08-13-2021

@jesse.garcia11 wrote:

Each site has a 5GB link to core.

1 Gbps to the core is already too much. I have wired and wireless on 1 Gbps and some sites barely use 20%.

@jesse.garcia11 wrote:

The main issue is the wireless devices on one SSID at each site were experiencing the same network issues, which was frequent timeouts, certain chromebook devices would not get to their login screens.

What kind of network issues? How is the SSID configured?

If this issue ONLY happens to Chromebooks, see if the "issues" can be replicated using different OS, like Windows, Apple or Android.

The most difficult part of troubleshooting for wireless is the lack of credible information. Users do not know so it is up to us to troubleshoot and ask the right questions. Get screenshots of error messages, MAC address of problematic clients, find a "common denominator" and exclude the rest.