Strange behavior with WLC 9800 and disabling broadcasting SSID on wlan

[czubachups]

Hello all,

we are running a WLC 9800-80 with 17.3.3 and have a strange issue with one of our networks. We have a wlan which has no authentication and should be hidden. It transmits on 5Ghz and 2.4 Ghz through the building. Now the WLAN stops transmitting on 2.4 Ghz as soon as we disable Broadcasting SSID. It still transmits on 5 Ghz when its hidden but completely stops on 2.4 Ghz. 

Is this a bug? we are only using C9130AXE-B as Aps. 

Any help or suggestion would be much appreciated. 

Thanks

Chris

[ammahend]

Sounds like a buggy behavior, How did you determine that it’s not broadcasting 2.4Ghz frequency when ssid broadcast is disabled. 
Also share RF profile/tag details associated with the wlan if possible when broadcast is disabled. 

[czubachups]

Sorry man 17.3.3 is pretty new for me, any idea how to fetch the RF profile/ tag details from the command line or the gui? We have a fluke which scans on all bands and we see the behavior that the APs do not transmit the specific wlan on 2.4 anymore. Only 5 GHz. Noticed the issue that suddenly a lot of Android phones which only support 2.4 couldn|t connect anymore but all the 5Ghz phones could. 

WLAN Profile Name : xxxxxxx
================================================
Identifier : 4
Description :
Network Name (SSID) : xxxxxx
Status : Enabled
Broadcast SSID : Enabled
Advertise-Apname : Enabled
Universal AP Admin : Disabled
Max Associated Clients per WLAN : 0
Max Associated Clients per AP per WLAN : 0
Max Associated Clients per AP Radio per WLAN : 200
OKC : Enabled
Number of Active Clients : 775
CHD per WLAN : Enabled
WMM : Allowed
WiFi Direct Policy : Disabled
Channel Scan Defer Priority:
Priority (default) : 5
Priority (default) : 6
Scan Defer Time (msecs) : 100
Media Stream Multicast-direct : Disabled
CCX - AironetIe Support : Enabled
Peer-to-Peer Blocking Action : Disabled
Radio Policy : All
DTIM period for 802.11a radio :
DTIM period for 802.11b radio :
Local EAP Authentication : Disabled
Mac Filter Authorization list name : Disabled
Mac Filter Override Authorization list name : Disabled
Accounting list name :
802.1x authentication list name : Disabled
802.1x authorization list name : Disabled
Security
802.11 Authentication : Open System
Static WEP Keys : Disabled
Wi-Fi Protected Access (WPA/WPA2/WPA3) : Disabled
OWE Transition Mode : Disabled
OSEN : Disabled
FT Support : Disabled
FT Reassociation Timeout (secs) : 20
FT Over-The-DS mode : Disabled
PMF Support : Disabled
PMF Association Comeback Timeout (secs): 1
PMF SA Query Time (msecs) : 200
Web Based Authentication : Disabled
Conditional Web Redirect : Disabled
Splash-Page Web Redirect : Disabled
Webauth On-mac-filter Failure : Disabled
Webauth Authentication List Name : Disabled
Webauth Authorization List Name : Disabled
Webauth Parameter Map : Disabled
Band Select : Enabled
Load Balancing : Disabled
Multicast Buffer : Disabled
Multicast Buffers (frames) : 0
IP Source Guard : Disabled
Assisted-Roaming
Neighbor List : Enabled
Prediction List : Disabled
Dual Band Support : Enabled
IEEE 802.11v parameters
Directed Multicast Service : Enabled
BSS Max Idle : Enabled
Protected Mode : Disabled
Traffic Filtering Service : Disabled
BSS Transition : Enabled
Disassociation Imminent : Disabled
Optimised Roaming Timer (TBTTS) : 40
Timer (TBTTS) : 200
Dual Neighbor List : Disabled
WNM Sleep Mode : Disabled
802.11ac MU-MIMO : Enabled
802.11ax parameters
OFDMA Downlink : Enabled
OFDMA Uplink : Enabled
MU-MIMO Downlink : Enabled
MU-MIMO Uplink : Enabled
BSS Target Wake Up Time : Enabled
BSS Target Wake Up Time Broadcast Support : Enabled
mDNS Gateway Status : Gateway
WIFI Alliance Agile Multiband : Disabled
Device Analytics
Advertise Support : Enabled
Share Data with Client : Disabled
Client Scan Report (11k Beacon Radio Measurement)
Request on Association : Disabled
Request on Roam : Disabled
WiFi to Cellular Steering : Disabled

[Scott Fella]

Maybe open a TAC case.  I just tested on 17.7.1 and once I disable broadcast, in a few seconds, I do not see the SSID anymore.  I was using WiFi Explorer Pro for my testing.

[czubachups]

Like it was still transmitting but hidden how it is suppose to be or wasn't it transmitting at all? Like could you still connect to it with a 2.4 Ghz phone and a 5 Ghz phone? 

[Scott Fella]

When I tested, I created a new SSID and mapped that to an existing profile.  I was able to connect and a few tools I have, I was able to see the SSID on both bands.  Once I disabled broadcasting, I was still able to connect, but the tools I have did not see the SSID.  It will show it as hidden.

[Scott Fella]

Just want to make sure you understand.  When you disable broadcasting, the SSID is still available, just hidden from tools/devices.  To disable the SSID from being active, you disable the admin status of the SSID.

[czubachups]

Understand, but this is not the case. we did not disable the admin status of the SSID. Phones cannot connect after the we hide the network.... says network not available anymore and our Fluke shows that it is still being transmitted but not on 2.4 only on 5. So Phones supporting 5 Ghz can connect to it when its hidden but no 2.4 phones. 

We did not disable the wlan, we only disabled Broadcasting. Afterwards any 2.4 phone cannot connect anymore after manually adding the networkjust 5 Ghz phones. as soon as we enable broadcasting 2.4 phones are able to connect again. 

We are using a net Ally Aircheck G2. 

[Scott Fella]

I can test again, I have a few NetAlly nXG's, but disabling broadcast does have negative affects on devices.  One thing to do, is to remove the profile on the device and manually create it.  If for example, the SSID was broadcasting when the profile was created, then the device expects that SSID to be broadcasted or else it will fail to join.  This is an issue with changing setting after a device has a profile.  My suggestion is the set your SSID, remove the profiles on the device, then manually create the SSID on the device.  Let us know what happens.

[czubachups]

First thing we tried to remove the profile and did manually add it again but it did not connect, got a network not reachable error on an android phone. The network doesn't use any authentication. The Aircheck shows that the hidden network is transmitting on several 5 Ghz channels but no one 2.4 Ghz channel they just disappear. as soon as we enable broadcasting SSID it shows the wlan on several 2.4 Channels and phones can connect.  

[Scott Fella]

I don't see that on my network using the NetAlly and WiFi Explorer Pro.  My devices, both iPhone and Samsung S21 can connect to the SSID on both bands as long as I manually add the profile.  So when the SSID is broadcasting, the tools see BSSID and when the SSID is set to not broadcast, the tools see the BSSID as hidden.

[czubachups]

Don't know what to tell you none of the 2.4 phones can connect as soon as the network is hidden. Only 5 Ghz phones are able to do so. 

[Scott Fella]

I don't know what to say.... Can a laptop connect?  If so, then maybe the device doesn't like when the SSID is hidden.  Like I mentioned, there are devices out there that need to see the SSID and even need to have the 2.4GHz enabled in order to connect to 5GHz.  If your devices don't support it, then your only choice is to enable broadcasting.  I don't ever see any enterprise networks that disables broadcasting.  Causes more issues folks have to deal with.

[Scott Fella]

My suggestion is to open a TAC case.  They might ask you to upgrade or downgrade, but that is something you can try before opening up a TAC case.  Keep in mind, I'm running 17.7.1 not the code you are running.

[czubachups]

Tried with a laptop as well same thing couldn't connect to the hidden network when wifi card was limited to 2.4 Ghz. worked fine with 5 GHz. This will be a TAC case for sure was just hoping somebody did see this behavior before.