802.1x Session Re-authentication timeout and DHCP

[kanansimpson]

Hello,

Has anyone experienced an issue with wireless client IP renewal on a 802.1x enabled WLAN/SSID when the Re-authentication timeout occurs?

Here is the issue..

I have a dot1x enabled WLAN. I have some wireless clients (a mixture/not the same) that will lose it's IP address after the Re-authentication timeout occurs. When this occurs, the client remains connected to the ap but will eventually show an APIPA address. I have enabled client debug on the the WLC and see that the client reauth logs after the timeout occurs. I know the reauth is fine (Client remains connected to ap). I've done several pcaps and it indicates that the DHCP server is receiving the Discover packet and replying with the Offer. However, the last place I see the offer packet is at the WLC up link port. From there, its not getting to the client to complete the process.

By default, the Re-authentication timeout is configured for 30 mins (or 1800 secs). As a work around, I've increase the Re-authentication timeout value to 12 hours. A 30 minute disconnect is not acceptable.

Has anyone experienced this issue or know anything about it?

Thanks Kindly.

[Ara]

What was finally causing the issue and what was the fix?

Thanks,

[Sam Brynes]

I"d like to know too. Time to spill the beans! :)

[jonas]

Disabling the session timer entirely on the SSID solves this in my case.  Disabling the DHCP required option, also solves this issue and is perhaps a better workaround.  It does seem as though something is wrong/different with the DHCP process for some specific clients, during re-auth.  In my case it is typically Linux operating systems that behave this way, where IP is registered as 0.0.0.0 in the WLC and only a reboot of the device, brings the device online again with an IP address, until session timer again forces the client to re-auth with 4 way handshake and then fails.  Still no understanding why this happens.  I definately prefer to have session timer and DHCP required enabled. By the way, I am not using DHCP proxy in the WLC, just pure layer 2 bridging.