Chromebook connected but unable to pass traffic

[Kenny69]

First of all, i am fairly sure this is a client issue, but decided to post this here anyway, just in case.

We are providing wireless services to a number of chromebook clients, and we have an issue where the chromebook client sucessfully associates, receives an ip address but are unable to pass any user traffic. These problems are very intermittant in nature, they occur sometimes, but not always.

I have done only very basic troubleshooting. I can see the client in the mac address table of the assigned vlan, but receive no response to ping sourced from the same vlan. The client matches the correct authorization profile and are assigned to the correct interface-group in the WLC. 

[marce1000]

             - Please provide WLC-model and software version used , 

 M.

[Kenny69]

9800-80 running 17.9.4a

[Leo Laohoo]

What is the model of the AP?

Is the authentication Dot1x or PSK?

[Kenny69]

AP Model is 2802i auth is Dot1x

[Leo Laohoo]

Google knows of an issue where the ChromeBook will drop traffic when authenticated with Dot1x.  This behaviour is easily replicated. 

We have reported this issue to Google back in 2019 but, because we had a tiny (25k) fleet and we were in Australia, we were not taken seriously. It wasn't until 2021 Google started getting reports from multiple clients did they finally took things seriously. 

We have asked for the Google Bug ID number but they would not provide it. 

The workaround is to use PSK and the dropout is not as severe.

[Kenny69]

@Leo Laohoo Thanks, anywhere i can read more about this isse?

[Leo Laohoo]

Report the issue to Google.  

[marce1000]

  - Have an overall  checkup of the 9800 WLC configuration with the CLI command show tech wireless and feed the output to : Wireless Config Analyzer

  For testing if you know to which AP a chromebook will connect to  ; issue this command first on the AP:
                          show  ap client-trace events mac aa:bb:cc:01:02:03 (the latter mac address must of course be changed accordingly ). Then during the connecting process (and later) follow up on the outputs shown or check the logs on the AP

   - Further engage in full client debugging according to https://logadvisor.cisco.com/logadvisor/wireless/9800/9800ClientConnectivity , these debugs can be analyzed with Wireless Debug Analyzer

  - Outputs from the commands mentioned in https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/217738-monitor-catalyst-9800-kpis-key-performa.html#anc5 can also be useful

                                            - Go for 17.9.5 which has become current advisory (especially if no resolutions from the above actions are in sight)

 M.