Solved: Strange issue with frequent client drops

IT Services · ‎11-13-2013

Good Afternoon,

I have some Apple based clients that are not staying associated with our Flex Connected AP's. I dont know for sure if it is all of our Apple (MAC OSX) clients or just a few particular clients.

Couple of questions I have off the bat:

* Aironet IE - does this essentially enable CCX? Or is this just part of CCX functionality

* I enabled 80211 association, dissociation and auth and deauth SNMP traplogs. I see alot of Associations logged for this client but no Dissocations. Anything strange about that?

Any other real world insight as to deploying a mixed environment CCX compliant Windows and Non-CCX compliant MAC. The Windows clients on the same APs stay connected and have an uptime of hours.

Thougths?

Scott Fella · ‎11-13-2013

Make sure if your using WPA WPA2, that you use either WPA/TKIP or WPA2/AES. Don't use both or a mix of one or the other. If your using WebAuth, then make sure the idle timer is set to 2 hours or more and disable the session timer. Session timer being disabled helps with my MacBook Air, but my MacBook Pro doesn't have issues with that enabled.

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***

View solution in original post

Scott Fella · ‎11-13-2013

Make sure if your using WPA WPA2, that you use either WPA/TKIP or WPA2/AES. Don't use both or a mix of one or the other. If your using WebAuth, then make sure the idle timer is set to 2 hours or more and disable the session timer. Session timer being disabled helps with my MacBook Air, but my MacBook Pro doesn't have issues with that enabled.

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***

IT Services · ‎11-13-2013

Scott Fella wrote:

Make sure if your using WPA WPA2, that you use either WPA/TKIP or WPA2/AES. Don't use both or a mix of one or the other. If your using WebAuth, then make sure the idle timer is set to 2 hours or more and disable the session timer. Session timer being disabled helps with my MacBook Air, but my MacBook Pro doesn't have issues with that enabled.

Sent from Cisco Technical Support iPhone App

Crap. How do i remove Correct Answer. Accidently clicked that.

Anyway. Any other thoughts to Aironet IE? Also what is the idea behind disabling Session Timer? Should i increase the DTIM instead maybe?

Scott Fella · ‎11-13-2013

DTIM I have set to 2 and session timers only affect MacBook Airs for some reason. This forces the client to reauth and at times the MacBook Air fails and I get an exclamation mark on the wireless connection. You need to define in more detail what's happening and what your config is. Post your show WLAN

Sent from Cisco Technical Support iPhone App

-Scott
*** Please rate helpful posts ***

IT Services · ‎11-13-2013

Scott Fella wrote:

DTIM I have set to 2 and session timers only affect MacBook Airs for some reason. This forces the client to reauth and at times the MacBook Air fails and I get an exclamation mark on the wireless connection. You need to define in more detail what's happening and what your config is. Post your show WLAN

Sent from Cisco Technical Support iPhone App

The one user is just stating that he is frequently getting disconnected sometimes before the session time. I can check to see if the user is doing anything to allow it to connect again:

(Cisco Controller) >show wlan 210

WLAN Identifier.................................. 210
Profile Name..................................... SSID_Location

Network Name (SSID).............................. SSID

Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Client Profiling Status ....................... Disabled
DHCP ......................................... Disabled
HTTP ......................................... Disabled
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Maximum number of Clients per AP Radio........... 200
Number of Active Clients......................... 122
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 1800 seconds
User Idle Timeout................................ 300 seconds

--More-- or (q)uit
User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... YUP
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ af-production2
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
mDNS Status...................................... Disabled
mDNS Profile Name................................ unconfigured
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
PMIPv6 Mobility Type............................. none
Quality of Service............................... Silver
Per-SSID Rate Limits............................. Upstream      Downstream
Average Data Rate................................   0             0
Average Realtime Data Rate.......................   0             0
Burst Data Rate..................................   0             0
Burst Realtime Data Rate.........................   0             0
Per-Client Rate Limits........................... Upstream      Downstream
Average Data Rate................................   0             0
Average Realtime Data Rate.......................   0             0

--More-- or (q)uit
Burst Data Rate..................................   0             0
Burst Realtime Data Rate.........................   0             0
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... None
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... All
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
   Authentication................................ 172.20.9.236 1812
   Authentication................................ 172.16.9.201 1812
   Accounting.................................... 172.20.9.236 1813
   Accounting.................................... 172.16.9.201 1813
      Interim Update............................. Disabled

--More-- or (q)uit
Dynamic Interface............................. Disabled
Dynamic Interface Priority.................... wlan
Local EAP Authentication......................... Disabled
Security

   802.11 Authentication:........................ Open System
   FT Support.................................... Disabled
   Static WEP Keys............................... Disabled
   802.1X........................................ Disabled
   Wi-Fi Protected Access (WPA/WPA2)............. Enabled
      WPA (SSN IE)............................... Disabled
      WPA2 (RSN IE).............................. Enabled
         TKIP Cipher............................. Disabled
         AES Cipher.............................. Enabled
                                                               Auth Key Management
         802.1x.................................. Enabled
         PSK..................................... Disabled
         CCKM.................................... Disabled
         FT-1X(802.11r).......................... Disabled
         FT-PSK(802.11r)......................... Disabled
         PMF-1X(802.11w)......................... Disabled
         PMF-PSK(802.11w)........................ Disabled
      FT Reassociation Timeout................... 20

--More-- or (q)uit
      FT Over-The-DS mode........................ Enabled
      GTK Randomization.......................... Disabled
      SKC Cache Support.......................... Disabled
      CCKM TSF Tolerance......................... 1000
   WAPI.......................................... Disabled
   Wi-Fi Direct policy configured................ Disabled
   EAP-Passthrough............................... Disabled
   CKIP ......................................... Disabled
   Web Based Authentication...................... Disabled
   Web-Passthrough............................... Disabled
   Conditional Web Redirect...................... Disabled
   Splash-Page Web Redirect...................... Disabled
   Auto Anchor................................... Disabled
   FlexConnect Local Switching................... Enabled
   flexconnect Central Dhcp Flag................. Disabled
   flexconnect nat-pat Flag...................... Disabled
   flexconnect Dns Override Flag................. Disabled
   FlexConnect Vlan based Central Switching ..... Disabled
   FlexConnect Local Authentication.............. Disabled
   FlexConnect Learn IP Address.................. Enabled
   Client MFP.................................... Optional
   PMF........................................... Disabled
   PMF Association Comeback Time................. 1

--More-- or (q)uit
PMF SA Query RetryTimeout..................... 200
Tkip MIC Countermeasure Hold-down Timer....... 60
AVC Visibilty.................................... Disabled
AVC Profile Name................................. None
Flow Monitor Name................................ StealthWatch FlowCollector
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
SIP CAC Fail Send-486-Busy Policy................ Disabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Disabled
802.11k Neighbor List Dual Band.................. Disabled
Band Select...................................... Disabled
Load Balancing................................... Disabled
Multicast Buffer................................. Disabled

Mobility Anchor List
WLAN ID IP Address Status
------- --------------- ------

802.11u........................................ Disabled

--More-- or (q)uit
MSAP Services.................................. Disabled

Scott Fella · ‎11-13-2013

Well.. I wouldn't rely on a user telling me thee is an issue. The session timer should be disabled, the DTIM I would set to 2. I would also check your radius logs to see if you see anything and I would also check the laptop to see if maybe the device is connecting to another wireless SSID set on the profile.

If all fails, debug client

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

-Scott
*** Please rate helpful posts ***