iPhone silent disconnect issue in guest wireless network.

[jegan_rajappa]

Problem Statement:

iPhone silent disconnect issue in guest wireless network.

Infrastructure setup:

• Guest wireless network has been configured with foreign and anchor controller with Cisco WAP/WLC and Cisco ISE with CWA.
• Open authentication.
• MAC Filtering enabled.
• SSID Session Timeout is configured with 43200 seconds (12 hours).
• User Idle Timeout is configured with 43200 (12 hours).
• WLC Model: 2504 and 5508.
• AP Model: 1602/1702/2602/2702/3702.
• Currently WLC is in 8.0.140.0 code, will be upgrading to 8.3.133.0 next week.
• Cisco ISE 2.2.
• iPhone model: I have only 5/6, IOS is upto date, but seeing the problem in all the IOS release, I mean checking from 10.0 trian, currently in IOS 11.1.2 which is latest.

Observations:

• After successful web authentication internet works well.
• Once device is locked and idle it looses the wireless connectivity silently, most of the times phone assumes wireless connection is down and start using cellular network, once phones receives any email or some traffic is generated through some background application through cellular network or if we unlock the device, phone tries to connect with wireless and it gets connected, we can see this transition in eyes easily, atleast phone takes 5 seconds to connect with wireless again, we can also see this by looking into uptime seconds in WLC client details page, without reauthentication phone has internet access reachability.
• Sometimes, approximately after one or two hours, we need to reauthenticate through CWA.
• We don’t have any issues with Andriod and windows laptop, all works as expected.
• Tried enabling/disabling client load balancing and Client Band select through SSID advanced settings, no luck.
• Debugs doesn’t give much details.
• Noticed this issue in ISE 1.3, so upgraded to 2.1, same issue, then upgraded to 2.2, still same issue.
• Noticed this issues in most of the iPhones.
• Same iPhones don’t have any issues with WPA2-AES-PSK, but noticing this issues only with open authentication setup.
• Tried enabling client user idle timeout in SSID advanced settings, no luck.
• Tried setting only 802.11a radio policy, no luck.

Tried raising several TAC case, no resolution, hence starting discussion here to see if anyone else experience same issues.

[Flavio Miranda]

Hi @jegan_rajappa

 Hopefully someone here comes  with a different opinion and solution for this case but for me this iphone fault and not network fault. I've been seeing people here complaining about it frequently. Searching for this on the internet, mainly Apple forums, we can see that this is an iphone behavior. The only new information you added for me is the fact that it happen in Open authentication only. 

 https://forums.macrumors.com/threads/iphone-6s-wifi-disconnect-while-locked.1957465/

https://www.applevis.com/forum/ios-ios-app-discussion/wifi-shuts-down-when-phone-locked

Here someone proposing a solution:

https://www.tanaza.com/blog/wifi-disconnects-sleep-mode-iphone-6s-ios-devices-problem-solved/

-If I helped you somehow, please, rate it as useful.-

[jegan_rajappa]

Hi Flavio Miranda,

After following below link problem seems like fixed, my iPhone is stable for last 30+ minutes.

https://www.tanaza.com/blog/wifi-disconnects-sleep-mode-iphone-6s-ios-devices-problem-solved/

This link explained the problem/Bug in iOS and also given directions to fix

https://monal.im/blog/ipod-ipad-disconnect-on-screen-lock/

I will do more validation tomorrow and come up with updates, Thanks !

[Scott Fella]

I think that is a good fix for internal user that use your guest, but how are you going to fix the issue with true guest users? Seems like something isn’t working as expected. We have a large number of guest user globally and not complaints like what you are seeing.

[jegan_rajappa]

Hi Scott,

In my case internal users usage/Incidents are very high compared with outside guest users, so i think iphone bug is the root cause of the issue, i will come up with update if any other issues noticed.

As of now all ok, Its great work guys, Thanks all for sharing your valuable comments.

Cisco support community support Rocks !!

[Flavio Miranda]

That's great and this is a problem very common here on the forum. So, finding a workaround would help many others.

 Thank you.

-If I helped you somehow, please, rate it as useful.-

[Leo Laohoo]

---

@jegan_rajappa wrote:

• Once device is locked and idle it looses the wireless connectivity silently, most of the times phone assumes wireless connection is down and start using cellular network, once phones receives any email or some traffic is generated through some background application through cellular network or if we unlock the device, phone tries to connect with wireless and it gets connected, we can see this transition in eyes easily, atleast phone takes 5 seconds to connect with wireless again, we can also see this by looking into uptime seconds in WLC client details page, without reauthentication phone has internet access reachability.

---

This sounds like Sleeping Clients and it seems to be working fine.

So what does the client want?  Do they want the iPhones to be CONTINUOUSLY connected to the wireless network even though the wireless clients have gone to "sleep"?

[jegan_rajappa]

We dont see same issue in Android, thats the big question. Some customers hate this solution, if they dont have cellular network, they miss all the emails, whatsApp messages, WhatsApp call etc. Once clients gets connectivity all messages comes in.. This created frustration to end users. I am managing approximately 6000 APs with 15000+ concurrent clients, so this issue is getting reported more and more everyday, at some point users are also stop using guest wireless :)

[Leo Laohoo]

Something is not right here.
Even though the wireless clients are in "sleep", the NICs should regularly "wake up" to determine if there are queued messages that are waiting for them. If there are none, then the clients go back to sleep and the process starts all over again.
Check the SSID settings and see if WMM is enabled or not. It sounds like U-APSD is disabled.

[Scott Fella]

I have not heard many complaints in our environment. Here is my suggestion. 

•Disable session timer

•Leave client idle timer at 300 seconds

•Enable sleeping client and set that for 4 hours.  (I take in consideration the amount of time a guest user might leave for lunch, break, etc.)

•Make sure your dhcp lease time is more than the sleeping client + idle timer

[jegan_rajappa]

Tried this in past, in this case client need to re authenticate very frequently, by default 300 seconds is configured in user idle timeout, i changed it to 43200 to solve frequent re authentication issue in all the devices, i have successful uninterrupted connection for 12 hours in Laptop and Android by tweaking this timer. Radius session timeout in ISE authorization profile is also set with 43200

[Scott Fella]

IOS functions different than Windows and Android.  When you increase the idle timer, it must be less than the session timer.  You need to use the sleeping client feature and not increasing the idle timer.  My iPhone 7+ is on our guest network and I have no issues coming out of sleep. 

[jegan_rajappa]

WMM is set as "Required" now, also tried with setting as "Allowed" 

in clients details tab, I am seeing WMM state as " Enabled" 

U-APSD Support "Disabled" 

[Leo Laohoo]

---

@jegan_rajappa wrote:

U-APSD Support "Disabled" 

---

There's another thing that doesn't make sense ... 

Why, with Android vs iOS, is this issue only happening to iOS.  I'd expect this to happen with Android, especially those who's running OS that actually DO NOT support U-APSD, but definitely not an iOS. 

Apple iOS has features in Notification settings.  Unless someone has gone to all the Apple-only devices and disabled Notifications across the board, I find it difficult to comprehend this is happening. 

I've got iPhone and I've got WhatsApp, Mail, Viber, etc.  I leave Notification at the default and when the phone has gone to "sleep", I get Notifications.  

[jegan_rajappa]

Here is event logs from both foreign and anchor WLC.

for some reason iPhone sends association request every one min or frequent..

It seems this problem is back.