join ssid failed at first several minites

[cco leadstarmcd]

we have 2 wlc, 9800 & 3504.

a wlan is deployed with same configuation from both wlc to 2 buildings.

wlan using 802.1x authentication by same nac.

user move from building a to b will suffer wifi connection failure at first several minutes.

nac got no authentication request  at this time.

wifi connection will restore automatically by waiting.

or

disable wlan nic and reenable.

user move from b to a will get the same problem.

any one encounter this problem??

and how to fix?

[MHM Cisco World]

do you use IRMC ?

https://www.ciscolive.com/c/dam/r/ciscolive/global-event/docs/2024/pdf/TACENT-2018.pdf

MHM

[cco leadstarmcd]

no,we do not use IRMC.

reconnect in 1-2 minute after user moving to other building is acceptable.

that is what I want.

roaming from one wlc to another is final solution if  there is no other way.

Thanks.

[MHM Cisco World]

Same SSID in both buildings this will make clients not ask re-auth.

Either use different SSID or use IRMC

MHM

[cco leadstarmcd]

just curious, what cause win 10 to wait a few minutes to make successful wifi connection?

After user walk out building A, the wifi connection is completely broken. The ssid even disappeared in wlan list.

so, after user walkin in building B, SSID reappeared, shouldnt win10 start full authentication process instead of re-auth?

[Flavio Miranda]

@cco leadstarmcd 

This is not a good scenario for wifi but you can try a few actions. Of  course the best scenario is integrate both WLC in the same RF group but, if you can not do that at the moment, you can try this.

 Your problem is probably related to stick cilent problem. The client tries to remain connected to the previous network as much as it can. Clients avoid roaming at all cost.

First, make sure the cell overlaping on the transition area is appropriate.  then you can improve this by keeping the driver up to date and configure the roaming sensitivity on the client´s network adapter to at leat medium.

 On the WLC,  use optimized roaming and RX-SOP on the APs at the border between two WLC. This feature can help on the process of diconnecting the AP from one SSID and reconnecting to the other.

You can also make tests with the feature "DHCP Addr. Assignment Required" to force client renew theis IP address on the transtition.

All this feature need to be tested first and used with caution.

[cco leadstarmcd]

9800 is recently deployed and 3504 is critical to daily operation.

so, I can not find time windows to test IRMC.

Can not figure out why network architecture staff need another WLC? even 3504 is capable to do the same job?

thank for advise.

[Rich R]

As per the previous comments and:
Run client debug (3504) or radioactive trace (9800) on the client MAC address to understand exactly what is happening when the client tries to roam.

[cco leadstarmcd]

thanks for reply.

I will make a radioactive trace.

[Rich R]

You can also use netsh wlan show wlanreport to get the Windows point of view of what is happening.
See https://support.microsoft.com/en-us/windows/analyze-the-wireless-network-report-76da0daa-1db2-6049-d154-7bb679eb03ed for more info.

It should go without saying that you should also make sure that the Windows network drivers are 100% up to date because the older Intel drivers (especially but also applies to eg RealTek) had known serious bugs:
https://www.intel.com/content/www/us/en/download/19351/intel-wireless-wi-fi-drivers-for-windows-10-and-windows-11.html

[Scott Fella]

I have to chime in on this.. I use to work at an organization that didn't have roaming enabled and for some odd reason didn't want to.  This caused very poor experience to the end users and really is a poor design/requirement.  There should be no issues setting up IRMC between the two and something you should test, so that you and others can compare the experience.  Like what was also mentioned previously, lower your TX power on AP's that are allowing this roam, which can force a full re-auth, but still roaming and TX power is preferred. Especially if people are on calls or meeting when they are walking from building to building... that will really give the network a bad name.

[cco leadstarmcd]

No roaming at all???

There is a old saying in China: Make decisions by BUTT

[JPavonM]

That seems to me like a Windows issue. Endpoint behaviour could be out of logic, specially Windows, and what you think it could be doing may be not happening.

If you say that after enetering bulding B Windows does not start connection in the previous minutes, then the good point to start is to collect a trace in Windows, collect a radioactive trace in the WLC, analyze them and compare.

For Windows you can use the below command:

netsh wlan set tracing mode=yes
===> REPRODUCE THE ISSUE AND WAIT FOR THE ERROR
netsh wlan set tracing mode=no

... and then analyze the trace with Microsoft Network Monitor and use these filters there:

1. Enable Windows parser under "Tools>Parser Profiles>Select Windows" and press "Set As Active"
2. Open the .etl Capture file.
3. Use this filter under "Display Filter" panel WLAN_MicrosoftWindowsWLANAutoConfig and click on "Apply".
4. Use these filters to troubleshoot authentication issues in-deep:or EAPOL or DHCP or N802_MicrosoftWindowsNWiFi or ONEX_MicrosoftWindowsOneX or ExAuthen_MicrosoftWindowsEapHost