AIR-CB21AG-E-k9 intermittent association to AP1220s

[marcbutler]

Hi All

I am hoping someone may be able to shed light on this issue for me.

I installed a Wireless network of 40 1220s for a client. At the time, the .11g standard was not available. So, we installed .11b and .11a in most of the APs. We performed coverage testing (they wanted a coveraged based system as opposed to a capacity-based system) on both .11a and .11b and found that there was coverage throughout the entire campus with .11b and minor blackspots around .11a. The customer was happy with this.

However, we have just supplied them with the AIR-CB21AG-E-K9 tri-band cardbus adapters (we have not supplied any .11g rado module upgrades for the AP as yet). Since that time, they have been complaining that whilst using the cards in either dual- or tri-mode, they have been having issues with roaming between overlapping cells when connecting to the .11a system, in that they will loose connectivity completely and start re-authenticating, which could take 5 mins, or perhaps not at all in some areas. The cards will not automatically trip down to use the .11b infrastructure which is known to be good at the same location. Yet, they have some dual-band cards and those seem to be fine in similar areas. Also, they have some AIR-CB21A-A-k9 cards, and they seem to work fine in most areas, in areas where the tri-band cards have problems.

The equipment that I have not mentioned that we have deployed is as follows:

AIR-Ap1220B-E-k9

AIR-RM20A-A-k9

Windows XP clients

LEAP and PEAP authentication in operation.

I hope that someone can shed some light on this, if this is a known issue with the cards, or that I might require a software upgrade (currently running VxWorks 12.02T1) to be able to support these cards (even though I am not running .11g).

Hope to hear from someone soon

Rgds

Marc

[rmiles]

Welcome to my hell!

About a month ago I arranged a trade-in deal with Cisco of all of our b gear (130 AP modules, and ~100 clients adapters both PCI and PC card) for g gear. The AP upgrades have gone completely smooth. The adapters upgrades have not. The PCI adapters produced many strange problems from PC's not longer booting to only allowing certain people to logon. Cisco told me to wait for a new client which would be coming in the future. So, I was forced to downgrade all of my PCI adapters back to b.

The PC card upgrades have been my main concern for the last two weeks. We are pure LEAP, 802.11g. Roaming in G is very bad. Sometimes it will roam almost seamlessly and you only see 1-3 pings dropped. Other times the LEAP process starts over or worse I lose my IP address and you can only get it back by doing a manual reauthenticate in the ADU. Over the past few days I have been sent numerous engineering releases of the ADU client and nothing has helped.

Today I spent 4 hours doing a site survey and the only time I had proper roaming was when using the old b card and client (ACU 1.3) or when using a Compaq card and the Funk Odyssey client.

My AP's are running the latest IOS 12.2(15)JA.

So, yes there are problems with the g cards. Big problems. My suggestion to you is that you open a TAC case immediately and let them know all of the details. This will hopefully expediate the resolution, which Cisco seems to be moving slowly on right now.

Good luck.

[jcosgrove]

I agree with rmiles@asante.org....

Stay away from the CB21AG card. I am running this card on all the clients and running 12.2(15)JA in the AP's with upgraded G radios in the AP's. Although I can't say at this point if the AP's radio really matters for the problem. At one point I had part of the network with the B radio and the other part was built with G radios and I saw the same behavior in both areas.

When I run the Client using only the cisco driver and let XP handle the configs for 802.1x and encryption it generally works fine but intermittently when the card goes to roam it scans and never comes back till about 3 - 5 mins later.

The situation gets a little better when I load the ACU software but still allow XP to handle the 802.1x but there are still events that cause it to scan and not come back.

When I use the ACU to handle everything it seems to work better altough there are still some times it scans off to nowhere. The main problem I have with using the ACU is that I can't seem to the the ACU 802.1x to work but LEAP works fine. Also I tend to use the machine credential for login and the ACU does not have an option for this. Also the ACU takes longer to log in and some of my startup scripts fail.

JC

[ctripp]

Hi Marc,

With VxWorks and the CB21AG we have found that the card works best with version 12.04 . In fact you cannot use MIC with the cards unless you are using 12.04.

Two bugs you should probably be aware of,

http://www.cisco.com/cgi-bin/Support/Bugtool/home.pl

CSCed86508

Externally found moderate defect:

cb21ag card with VxWorks .11A radio constantly LEAP reauthenticates

The Fix for this:

- Windows Start >>> Settings >>>Control panel >> Administrative tools >>>

Services >> and Stop "windows zero configuration " if running.

CSCee12279

Externally found severe defect: Resolved (R)

cb21AG does not roam appropriately

Release-note:

When roaming between four (all valid ) APs, the cb21ag card does not roam until

a connection is fully lost for anywhere from 1 second to 2 minutes. Prior to roaming

as many as 19/20 pings can be lost with three other stronger APs available and the

card will not roam.

The security feature "allow mixed cells" on the security dialog does not appear to

be working correctly. In networks where APs have multiple VLANs mapped to muliple

SSIDs, and the SSIDs have a mix of WEP and open encryption, depending on the timing of

beacons and probe requests an AP may be excluded from roaming selection incorrectly.

Workaround: Try clicking the "allow association to mixed cells" check box on

the security tab of the profile for the SSID with the poor roaming behavior.

If the issue is the case explained above, roaming behavior will improve.

CSCee12279 is resolved in the upcoming general deployment release for the CB21AG.

Regards,

Charlie.

[jcosgrove]

Any aprox release date for the GD release of CB21AG ??

Also we are running using the driver only install. Is there any documentation available for the "Map Registers" for the interface card. I would like to make some adjustments in the cards behvior without loading the full blown client.

[ctripp]

The General Deployment release is definitely slated for the month of June. If I get a more definitive date on this, I will post it for you guys on this thread.

[marcbutler]

Many thanksfor all your replies.

In the end, we have decided to upgrade to the latest IOS to try to alleviate this issue.

In my testing I found that if we used the AIR-CB21AG-E-k9 cards with only .11a and .11b mode turned on, then roming between the cells was almost seamless (1 or 2 lost pings). But when I turned on WDS, then there were no losses!!!

But that still has not really resolved the issue! The client that I am working for with this issue is still complaining that his clients (XP Pro SP1, with some slightly dodgy drivers from a company who specialist in School deployments of windows) still cannot authenticate at times, then at others it can.

In fact, this problem may we now be related to another issue (which I am going to post in another thread). Basically, previously with the VxWorks APs we had a single SSID and had 2 VLANs associated to it. Assignment to eac VLAN was controlled on a per-user basis by the RADIUS server (a Cisco ACS). This worked very well under VxWorks (apart from the roaming issues). However, since the upgrade, the second VLAN on all of the APs has been deleted from the config. And when I try to assocaite the second VLAN to it, it tells me that only one VLAN can be associated to 1 SSID!!!!!!!!!!!

Cisco, you changed this and did not tell us!!!!

How can I get around this? I need to keep the same set up as before, that is, associate 2 VLANs to 1 SSID and allow the RADIUS server to assign the VLANs that a user should be put into according to their user credentials!!

Please, if anyone can help, it would really be appreciated!!

Thanks

Marc

[ctripp]

Hi the latest version of ADU software and driver is now on Cisco.com.

[rmiles]

Grabbing it now. I hope this card will become stable at some point. I have been working with the wireless DE's for a month now and there's been no resolution to our problem.

It's also funny that even though I speak with them almost daily they hadn't mentioned that a new client was coming out today.

[rmiles]

Now I know why the DE didn't mention it to me. Because he sent it to me on Thursday. I figured it was a engineering release, but the version is the same as the one posted (1.1.0.10).

[jcosgrove]

Any early opinions on this new driver yet?

[rmiles]

I can say that it has not resolved my roaming problems. My two main problems are that when roaming I sometimes loose my IP address completely. And my second concern, although not a crucial need, is that with my Cisco b clients I rarely miss a ping when roaming whereas the best I ever see is 3-5 missed pings when roaming from AP to AP.

[jcosgrove]

What is your configuration? I am running :

Windows XP using the wireless Zero configuration to take care of Authentication and encryption. Cisco CB21AG card with a driver only installation. We are set up to do WPA and TKIP for the Auth and encryption. Running WDS and using WPA for centralized keying. It does not seem to relate to signal strength or anything. Today I was standing right next to some nurses doing some entry on the PC and they said the screen froze. The application then logged them off and about a minute later they reconnected. The only evidence is that the AP shows a few Authentication Errors when this happens.

I have been working with a DE as well and not sure if they have captured any problem yet or what is known about this.

[rmiles]

Our config is Win2k clients, a/b/g PC cards, LEAP/ACS, 1231 AP's.

I have configured WDS in the way you have and it didn't make a difference.

The DE has had me adjust the scan time via a reg hack. I have also captured logs for them with some tools they sent to me (linkmon and a debug tool).

[jcosgrove]

I did the same with the DE. I think I have to start looking at other cards. The answers are not coming fast enough. I know this takes time but I am running out of time on this.