FlexConnect Local Switching - Client roaming issues.

[sardarjion]

I have a simple setup of WLC 2504 v8.3.150.0 + 1142 + 2702 + RVS 4000 router with no VLAN. 

My requirement is to setup these two APs in FlexConnect mode. I have provided the snapshots of settings for the SSID. 

I have created a separate AP group for these two APs in FlexConnect mode. My main problem is client roaming is not working. I have Win 10 Lenovo T490s laptop where I start a continuous ping to one wired machine on network. The laptop connects to 2702 and pings start. Now I move the laptop to different room closer to 1142 and 2702 completely goes away as I move to one corner of the room. The expectation is that laptop should connect to 1142 and pings should continue. I see initial request timeouts and then general failures as I lose the IP address. The only way to reconnect is to turn of the laptop wifi and then turn on again. 

I did another experiment where I simply just disabled the option "FlexConnect Local Switching" and roaming works flawlessly. So maybe I am missing some setting which is causing this roaming failure. 

Any help would be appreciated. Thanks. 

[marce1000]

 - You need to consider that  WLC 2504 v8.3.150.0 + 1142    are getting old. also that you can not go beyond 8.3.x with the 1142 could be considered a serious showstopper for these kind of problems, because usually being able to use the latest aireos version(s) will improve this problem.

 M.

[sardarjion]

I have additional 2702 and did the experiment and still the same result. I think once I know the actual problem it is easy to figure out if 1142 will do the job or not. And given this FlexConnect feature has been there for long since 7.xx I doubt this basic feature will have a bug like above. It has to be some step I am missing. 

Reason to have 1142 is because I have a low throughput requirement in part of the home and having 2702 would be an overkill. 

[marce1000]

 - I would still strongly advise to get rid off the 1142(s) , and look into https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html , any AP can do low throughput, it's usually the other way when the problem begins.... Actually https://software.cisco.com/download/home/283848165/type/280926587/release/8.5.171.0 , is the last available release for the 2504 (it can not go beyond that) , but is still applicable versus the very old 8.3.x

 M.

 M.

[sardarjion]

I wish it was as easy as just upgrading the OS. I upgraded the OS to 8.5.x version with two 2702 in flexConnect mode and problem is same. 

[marce1000]

 - Have a checkup of the controller configuration, for that you need to save the output of show run-config with no prompts and let that that be analyzed with : https://cway.cisco.com/wireless-config-analyzer/

 M.

[sardarjion]

Tried it and it doesn't show any errors related to FlexConnect configuration. 

30128 Error Config Error CleanAir CleanAir: CleanAir BLE Beacon detection signature has significant performance impact, it is recommended to run CleanAir enabled, with this specific device type disabled, unless required by deployment
30012 Error Config Error AP Manager AP Manager: AP manager interfaces count less than number of active ports, and no LAG, not supported configuration
120003 Error Best Practices Security Security: It is recommended to monitor all channels for rogue detection. Band(s): 2.4GHz,5GHz
120010 Error Best Practices Security Security: WLAN may be using management vlan. It is recommended to never set SSID into management vlan, even for anchor scenarios. WLAN(s): SSID1, SSID2

[marce1000]

 - Make sure that wireless drivers of the host (Wifi-Adapter) are up to date and or install the latest (if applicable) , 

 M.

[sardarjion]

Apart from the laptop, I tried with iPhone 13 also and result is the same. The main issue is roaming is broken in Flex mode. Roaming works fine in local mode so it has to be some setting on wlc and not a client issue. 

[marce1000]

 - Look into roaming settings such as 80211k and 80211v , check if enabling or disabling those makes any difference, 

 M.

[Scott Fella]

I run FlexConnect at home but with 9800 controllers now. I did run a 2504 for a while and had no issues, but my access points were all 802.11ac compatible. Having a mix of 802.11n and 802.11ac will always make the client prefer the newer protocol. That is just how manufacturers design it.

Anyways, try to disable FT and give it a go. I’m assuming that the AP’s are connected to a trunk and clients are on the same subnet. Might be your L3 switch/router since the Mac is moving from one ap to another. With local mode, everything gets tunneled back to the 2504. I use to run an ISR and now a Meraki MX do to all my routing function with no issues. I have 7 access points for testing in my home all on FlexConnect with no issues roaming at all.

[sardarjion]

Hi Scott,

The setup is as simple as it get. No VLANs enabled and just one single interface on WLC which connects to router directly. No additional switches in the way. The second AP is placed in another room but a cable extends from router's one port and powered via DC adapter. Both APs are 2702 with WLC version 8.5.182. 

I think I know the problem but not sure what the solution is. The main issue is that when I enable the "FlexConnect Local Switching" option the client is unable to reach the DHCP server and get IP address. 

The router has gateway/DHCP IP as 192.168.1.1 and gives clients dynamic IP of 192.168.1.1XX. When I turned of the "local switching" option the client gets the IP right away. I am testing all this on the AP which is connected to WLC's POE port and WLC is connected to router. Right now, I am not even testing roaming across APs as the basic scenario is broken. 

I tried enabling the below commands on wlc console

(Cisco Controller) >debug dhcp packet enable

(Cisco Controller) >debug dhcp message enable

but when the issue happens I dont see any DHCP activity. On the iPhone Wifi settings, I just keep seeing the spinning progress bar after I enter password and it never gets an IP address. On my laptop with wireshark enabled, I see laptop is trying to send DHCP messages but never get a response. It makes me think the AP is somehow dropping the DHCP packets and not forwarding them. 

Here is how the settings look. 

[m.george]

Hi,

I suspect the issue is not with the wireless side but with the switch side. I'm working on a similar issue at present and it appears that, when in flex connect mode, the client associates with the new access point but the switched network doesn't like the change in MAC address location so the client cannot refresh the IP address. See all sorts of odd results. If the client changes to a different SSID that also changes the VLAN they present on then they have no problem. If they connect to an SSID that is different but presents to the same VLAN the issue persists. Even changing to a new SSID and connecting then changing back and attempting to connect to the old SSID does not clear the issue for the original SSID. I'll post here if I find the answer to the issue I'm facing, but this may help someone else focus in the right direction in the meantime.

[sardarjion]

Bump. 

[JPavonM]

This sounds to me that you're hitting CSCwd91054 where the windows clients turns from using OKC to SKC.

That would explain why clients are not been disconnected in Local Mode but they are ain Flex mode, as in the local scenario it's the WLC which controls the PMKID, and in the Flex scenario it is the AP so there is a mismatch on the PMKID.

The client is disconnected forl 180 secons (this is default windows timer for a new full authentication ) or until you reconnect.

As disabling OKC is not an option in AireOS (but it is in IOS-XE), try enabling SKC and disabling FTon the WLAN and test:

config wlan security wpa wpa2 cache sticky enable <your_wlan_id>