Cisco 1815i (Mobility Express) dropping certain clients

[Flaming Badger]

Hi,

I was wondering if anyone had encountered any problems with Cisco 18xx series access points dropping wireless clients unexpectedly? 

The background is that I wanted to move away from a Ubiquiti Wireless setup at home and head back to a Cisco based wireless system - mainly as we use these things at work and gaining a bit more familiarity with them couldn't hurt.  I went for a AIR-AP1815i-x-K9C (the Mobility Express bundle) and having upgraded to the latest software (8.8), things seemed to be working fine in most cases.  However, I have a bunch of wireless plugs (TuyaSmart) which allow lamps and things to be turned on and off remotely, drop off after about 12 hours.  Admittedly, these aren't the most expensive things in the world but they have been 100% reliable on the old Ubiquiti setup.  They operate at 2.4Ghz only.

I'm finding on the 1815i, these devices are dropping off the wireless and I can't see any obvious reason why.  They all go at the same time and the only way to get them back is to reboot the AP.  I apperciate I need to delve into the controller logs (which I haven't had time to do yet) but wondered if anyone else had experienced similar problems or knew of any settings/bugs that might be causing this?  I'm confident the problem is related to the new Cisco AP - given the reboot brings things back and the reliable history with the old setup.

Any ideas and thoughts welcome!

Thanks

[patoberli]

Just to make sure, which exact 8.8 software are you running?
Can you check if session timeout is enabled?
Enter the following on the CLI:
show client detail {client-mac-address}
If so, set it to 0 to disable it.

[Flaming Badger]

Hi,
The software is 8.8.111.0. I'll check session timeout and get back to you.
Cheers!

[Flaming Badger]

Hi,

Just checked and I see the following output under show client detail <mac> for one of the affected clients. I'm guessing this means timeout is already disabled?

Session Timeout.................................. 0

[patoberli]

Yes, that means it's disabled.

Could you post the full output? Maybe we see something else.

[Flaming Badger]

Here you go.

Client MAC Address............................... 2c:3a:e8:4a:ee:35
Client Username ................................. N/A
Client Webauth Username ......................... N/A
Hostname: .......................................
Device Type: .................................... Unclassified
AP MAC Address................................... 00:5d:73:4f:5c:60
AP Name.......................................... AP1
AP radio slot Id................................. 0
Client State..................................... Associated
User Authenticated by ........................... None
Client User Group................................
Client NAC OOB State............................. Access
Wireless LAN Id.................................. 2
Wireless LAN Network Name (SSID)................. IOT
Wireless LAN Profile Name........................ IOT
Hotspot (802.11u)................................ Not Supported
Connected For ................................... 267 secs
BSSID............................................ 00:5d:73:4f:5c:61
Channel.......................................... 1
IP Address....................................... 192.168.77.115
Gateway Address.................................. 192.168.77.254
Netmask.......................................... 255.255.255.0

--More-- or (q)uit
Association Id................................... 3
Authentication Algorithm......................... Open System
Reason Code...................................... 1
Client IPSK-TAG.................................. N/A
Status Code...................................... 0
Session Timeout.................................. 0
Client CCX version............................... No CCX support
QoS Level........................................ Silver
Avg data Rate.................................... 0
Burst data Rate.................................. 0
Avg Real time data Rate.......................... 0
Burst Real Time data Rate........................ 0
Avg Uplink data Rate............................. 0
Burst Uplink data Rate........................... 0
Avg Uplink Real time data Rate................... 0
Burst Uplink Real Time data Rate................. 0
802.1P Priority Tag.............................. disabled
Security Group Tag............................... Unknown(0)
KTS CAC Capability............................... No
Qos Map Capability............................... No
WMM Support...................................... Enabled
APSD ACs....................................... BK BE VI VO
Current Rate..................................... 54.0

--More-- or (q)uit
Supported Rates.................................. 1.0,2.0,5.5,11.0,6.0,9.0,
............................................. 12.0,18.0,24.0,36.0,48.0,
............................................. 54.0
Mobility State................................... Local
Mobility Move Count.............................. 0
Security Policy Completed........................ Yes
Policy Manager State............................. RUN
Pre-auth IPv4 ACL Name........................... none
Pre-auth IPv4 ACL Applied Status................. Unavailable
Pre-auth IPv6 ACL Name........................... none
Pre-auth IPv6 ACL Applied Status................. Unavailable
Pre-auth Flex IPv4 ACL Name...................... none
Pre-auth Flex IPv4 ACL Applied Status............ Unavailable
Pre-auth Flex IPv6 ACL Name...................... none
Pre-auth Flex IPv6 ACL Applied Status............ Unavailable
Pre-auth redirect URL............................ none
Audit Session ID................................. fc03a8c0000000033bd36a5c
AAA Role Type.................................... none
Acct Interim Interval............................ 0
Local Policy Applied............................. none
IPv4 ACL Name.................................... none
AAA FlexConnect ACL Applied Status............... Unavailable
IPv4 ACL Applied Status.......................... Unavailable

--More-- or (q)uit
IPv6 ACL Name.................................... none
IPv6 ACL Applied Status.......................... Unavailable
Post-auth Flex IPv6 ACL Name..................... none
Post-auth Flex IPv6 ACL Applied Status........... Unavailable
Layer2 ACL Name.................................. none
Layer2 ACL Applied Status........................ Unavailable
mDNS Status...................................... Disabled
mDNS Profile Name................................ none
No. of mDNS Services Advertised.................. 0
Policy Type...................................... WPA2
Authentication Key Management.................... PSK
Encryption Cipher................................ CCMP-128 (AES)
Protected Management Frame ...................... No
Management Frame Protection...................... No
EAP Type......................................... Unknown
FlexConnect Data Switching....................... Local
FlexConnect Dhcp Status.......................... Local
FlexConnect Vlan Based Central Switching......... No
FlexConnect Authentication....................... Central
FlexConnect Central Association.................. No
FlexConnect VLAN NAME............................ management
Quarantine VLAN.................................. 0
Access VLAN...................................... 777

--More-- or (q)uit
Local Bridging VLAN.............................. 0
Client Capabilities:
CF Pollable................................ Not implemented
CF Poll Request............................ Not implemented
Short Preamble............................. Implemented
PBCC....................................... Not implemented
Channel Agility............................ Not implemented
Listen Interval............................ 100
Fast BSS Transition........................ Not implemented
11v BSS Transition......................... Not implemented
Client Wifi Direct Capabilities:
WFD capable................................ No
Manged WFD capable......................... No
Cross Connection Capable................... No
Support Concurrent Operation............... No
Fast BSS Transition Details:
DNS Server details:
DNS server IP ............................. 1.1.1.1
DNS server IP ............................. 9.9.9.9
Assisted Roaming Prediction List details:


Client Dhcp Required: False

--More-- or (q)uit
Allowed (URL)IP Addresses
-------------------------

AVC Profile Name: ............................... none
OpenDns Profile Name: ........................... none
Fastlane Client: ................................ No
Max DSCP: ....................................... 0
Nas Identifier: ................................. WLC
Client Statistics:
Number of Bytes Received................... 37339
Number of Bytes Sent....................... 3384
Total Number of Bytes Sent................. 3384
Total Number of Bytes Recv................. 37339
Number of Bytes Sent (last 90s)............ 500
Number of Bytes Recv (last 90s)............ 19472
Number of Packets Received................. 829
Number of Packets Sent..................... 24
Number of Interim-Update Sent.............. 0
Number of EAP Id Request Msg Timeouts...... 0
Number of EAP Id Request Msg Failures...... 0
Number of EAP Request Msg Timeouts......... 0
Number of EAP Request Msg Failures......... 0
Number of EAP Key Msg Timeouts............. 0

--More-- or (q)uit
Number of EAP Key Msg Failures............. 0
Number of Data Retries..................... 0
Number of RTS Retries...................... 0
Number of Duplicate Received Packets....... 0
Number of Decrypt Failed Packets........... 0
Number of Mic Failured Packets............. 0
Number of Mic Missing Packets.............. 0
Number of RA Packets Dropped............... 0
Number of Policy Errors.................... 0
Radio Signal Strength Indicator............ -43 dBm
Signal to Noise Ratio...................... 45 dB
Client Detected as Inactive................ No
Client RBACL Statistics:
Number of RBACL Allowed Packets............ 0
Number of RBACL Denied Packets............. 0
Client Rate Limiting Statistics:
Number of Data Packets Received............ 0
Number of Data Rx Packets Dropped.......... 0
Number of Data Bytes Received.............. 0
Number of Data Rx Bytes Dropped............ 0
Number of Realtime Packets Received........ 0
Number of Realtime Rx Packets Dropped...... 0
Number of Realtime Bytes Received.......... 0

--More-- or (q)uit
Number of Realtime Rx Bytes Dropped........ 0
Number of Data Packets Sent................ 0
Number of Data Tx Packets Dropped.......... 0
Number of Data Bytes Sent.................. 0
Number of Data Tx Bytes Dropped............ 0
Number of Realtime Packets Sent............ 0
Number of Realtime Tx Packets Dropped...... 0
Number of Realtime Bytes Sent.............. 0
Number of Realtime Tx Bytes Dropped........ 0
Nearby AP Statistics:
AP1(slot 0)
antenna0: 269 secs ago................... -40 dBm
antenna1: 269 secs ago................... -40 dBm

[Flaming Badger]

OK - I think I've resolved this and it comes down to DHCP and probably a misunderstanding on how this is supposed to work.  I assumed that DHCP requests would be passed out into the wider VLAN and the router which is responsible for DHCP would respond.  When I configured a DHCP pool on Mobility Express, the devices that were missing immediately came online so my guess is that they were working until the lease issued to them by the old wireless system expired.

I'm happy to use Mobility Express as a DHCP server but I'm interested to know if there is a way to bypass this and go back to using the scope already defined on the router instead?

[Haydn Andrews]

you could use DHCP Proxy to send the DHCP requests to the routers DHCP server.

[patoberli]

Normally you don't configure a DHCP server on the ME at all. Then the DHCP packets from your clients will be broadcasted automatically into the VLAN the WLAN is assigned to. 

There are also some advanced features, which might be hidden in the default GUI (I haven't an ME here to test atm). 

In the case of a WLC based Wi-Fi, if you have DHCP Proxy enabled, you also need to configure the DHCP Server IP Address on the virtual interface.

You find some commands for this here:

https://www.cisco.com/c/en/us/td/docs/wireless/access_point/mob_exp/83/cmd-ref/me_cr_book/me_ports_and_interfaces_cli.html

[Flaming Badger · Accepted solution]

So after bashing my head against a brick wall with this for ages, I finally lost my mind when I rebooted the AP running ME and it went into a reboot loop with "waiting for preferred uplink" messages.  I tore my router's ZBF policies to pieces to make sure that there weren't any issues there but that was all good so it had to be something to do with Mobility Express or the AP.

As a final "hail Mary", I factory reset the AP running ME and ran through the setup again.  This time, everything worked immediately and I've had no issues with DHCP since.

I can only assume that having received the AP running 8.4 out of the box, applying some config and upgrading to 8.8.111.0 - some legacy config not compatible with 8.8 caused problems. I guess in future I should read the upgrade steps before proceeding! =)

Either way, the problem appears to have been resolved and I'm now a lot more comfortable with the 18xx series.

Thanks to all who took time out to pose thoughts and ideas, your input was very much appreciated.