Some users can't see open Wifi SSID

[Koldts]

Hello,

I run an enterprise network for an education institution

I've been informed that in one of our sites some users are not able to see our open wifi SSID (Completely open with optional OWE Transition on a hidden SSID). These users can see eduroam and our own password protected wifi, but not the fully open one. This is for both domain joined PC's and for student PC's. I can see users connected to the open wifi on both 2,4 and 5 GHz on the site, so not all users have this problem. I have a front service colleague that are not able to see the open wifi on his newly deployed PC, but can see it on his phone. The wifi setup is exacly the same on all our sites.

I think the problem started a month ago when we upgraded our 9800-40 to 17.9.4 from 17.3.6. All our AP's are 9120AX.

Do anyone have a clue what could be happening with the clients?

[Koldts]

I am not strong in what BSSID is, but i hope you mean something like this?
We had 4 including the hidden OWE SSID. Now we have 3.
Where our Flex Connect AP's are with IoT networks, we have as of now without OWE, between 4 and 5 SSID's on those AP's.
These Flex Connect AP's account for only 50 AP's out of our 1025 AP's we have total.

All our WLANs are broadcasted on both 2,4 and 5 Ghz but we prefer 5.

[Rich R]

The BSSID is the unique MAC address per SSID per radio.  I've linked one article about it and you'll find many others if you search.  On a Cisco AP the BSSID's are all allocated with MAC addresses counting up from the AP base wireless MAC address.
So if you have 5 SSIDs enabled across 3 radios that means you will have 15 BSSIDs.  I suspect some of the bugs might be triggered when there is a large number of BSSIDs so another reason to keep the number of SSID to as few as possible.  I can't find it now but I'm sure I saw a bug recently for AP running out of memory causing problems due to number of BSSID.

[pieterh]

just curious: what happens if you manually enter the SSID just like you would with an hidden SSID ?

I also suggest to check how many SSID's are present at the remote site 
some clients have a limit in how many SSID's are shown to select 
if there are a lot of "rogue" access-points, this can fill the list of shown SSID's with no space left for your enterprise SSID.

[Leo Laohoo]

---

@Koldts wrote:
Our TAC Case guy tried to create our network in his LAB, and he couldn't see any problem at all.

---

What?  Is this some kind of a joke???

TAC cannot "reproduce" anything because they do not have access to hardware.  TAC uses IoL (IOS over Linux) but they require to replicate potential AP-related issues.  And TAC does not have access to APs.  Next, a lot of the issues emerge after prolong use.  Days, weeks, months and not a few hours in a *cough*, "lab", *cough.

Going forward, please remote into one of the APs known to be exhibiting the problem, and furnish the output to the following commands: 

1.  sh logs

2.  sh dot11 wireless

3.  Uptime of the AP (from the controller, use the command "sh ap uptime")

IF, for example, an offending AP is rebooted, does the problem go away? 

Because this is beginning to smell like CSCwe15338.

[JPavonM]

Out oif curiosity, when you say "Completely open with optional OWE Transition on a hidden SSID" is becuase you have not enabled "Broadcast SSID"?

If that is the case, you will never see the SSID, nor any BSSID from any AP there.

Cloaking a SSID is not a best practice nor this is supported by the standard.

In that case, to connect to the SSID you need to manually create the profile on the device with the exact same capabilities that you've configured, Open or OWE.

[Koldts]

@pieterhWhen i connected to our Guest SSID when it had hidden OWE transition on, on my phone it would then tell me i was connected to the OWE network, even though it was hidden. We are a educational institution so we might have many rogue APs in form of hotspots or something from the students.

@leo4His exact words were "I have tested in lab and can view the OWE ssid"
He then wanted me to go to the site and deploy a sniffer AP so we could do some OTA captures, but when i went there everything was fine so that's when i closed the TAC case.
I will keep that in mind if we're going to deploy our OWA solution again, but as of now we wont.

@JPavonMYes, our OWE network was not broadcasting on our AP's, thats what i call hidden. When it worked on WLC version 17.3.7, when i connected to the Guest wifi (I would only see our cert/password SSID, eduroam SSID and Guest SSID), it would tell me it was enhanced open and connected to Guest. When our problem occured it would tell me i was connected to Guest-OWE or not showing our Guest SSID at all. Also it would sometimes show Guest-OWE on the wifi list even though it was not broadcasting

[Leo Laohoo]

---

@Koldts wrote:
His exact words were "I have tested in lab and can view the OWE ssid"

---

I am almost certain that is a lie.  

If ever I have a TAC case and the Agent would respond about "testing in a lab", I would always ask for their testing methodology.  They would try to avoid replying that they are using VM.  I need to ask "the right questions" before they will feel "trapped" and finally admit they do not have physical hardware to attempt to reproduce.

[Rich R]

Exactly: ask what hardware they used, what software version they used and a diagram showing the network topology they used in the lab.  And ask for actual output from the device like "sh ver" etc to compare to your own.  It will very quickly become obvious if they were just using an emulator rather than real hardware.
We've also had trouble with them testing something on a Wave 2 AP (2800) for a problem with WiFi 6 APs (91xx) and then the commands they told us to use (which they claimed to have tested) didn't work on the 9100 AP.  After quizzing them (because it obviously had not been tested correctly) they admitted they had only tested on 2800 and because it's different hardware the commands don't work on 91xx!  The excuse - they did not have access to any 91xx APs - yes this is Cisco TAC telling us they could not test anything on a WiFi 6 AP just a few months ago!

[Leo Laohoo]

@Koldts, 

I agree with what @Rich R has to say.  TAC will be unable see any discrepancies if this turns out to be another one of those 911X/912X Broadcom (BCM) wireless chip design fault.  

Be prepared because if you want to get to the bottom of this you will need to drag your accounts team (kicking and screaming) into this case as well as escalate this case up WNBU.  

TAC will do their utmost best to waste your time.  One of the "action item" you'll be asked to perform (numerous times over numerous days) is to get an over-the-air (OTA) packet capture as well as wired packet capture from an AP with known issue.  Like us, we spent several hundred hours.  

[pieterh]

Hoi there

>>> When i connected to our Guest SSID when it had hidden OWE transition on <<<
maybe a simple thing: do NOT use a device that has already connected on a site that functions correctly
you are troubleshooting a remote site that behaves differently , -> go to the remote site (or instruct a local ICTér to assist)
you are troubleshooting a (one or more) device that is differently than your own device -> use that device for troubleshooting

>>> Also it would sometimes show Guest-OWE on the wifi list even though it was not broadcasting <<<
yes that happens, if someone in your neighborhood is connected to the hidden Guest-OWE SSID, packets for this SSID are still sent over the wireless (though not broadcast)
that is why making an SSID hidden is NOT a security solution