Using OWE Transition and Client Steering to put guests on 6 GHz

[David Albrecht]

Hello,

We're running a network full of C9136 APs on 9800s running 17.9.3 with a open and unsecured guest network on 5GHz.

I want to use OWE transition and client steering to get 6E-capable clients onto a OWE/6GHz WLAN.

I've setup the OWE transition according to this doc and I am seeing clients seamlessly connect to the open Guest network, and then get put onto the OWE network.  However, none of the clients are getting steered onto the 6GHz radios, even though the clients are 6E-capable. 

If I create a separate 6E WLAN and broadcast it, the clients can connect to it just fine. So, it's gotta be something with the client steering and OWE transition.

Any tips on things to check?

[Leo Laohoo]

What country is the AP installed in?

[David Albrecht]

This is in the USA.

[marce1000]

 - Have a checkup of the 9800(s) controller configuration with the CLI command show tech wireless ; feed the output into :
                                 https://cway.cisco.com/wireless-config-analyzer/

 M.

[ammahend]

share output below and use this document for verifying config 

show wireless client steering
show wlan wlan-id 

[David Albrecht]

Here is the output of "show wireless client steering":

Client Steering Configuration Information
  Macro to micro transition threshold                  : -55 dBm
  Micro to Macro transition threshold                  : -65 dBm
  Micro-Macro transition minimum client count          : 3
  Micro-Macro transition client balancing window       : 3
  Probe suppression mode                               : Disabled
  Probe suppression transition aggressiveness          : 3
  Probe suppression hysteresis                         : -6 dB
  6Ghz transition minimum client count                 : 0
  6Ghz transition minimum window size                  : 0
  6Ghz transition maximum channel util difference      : 20%
  6Ghz transition minimum 2.4Ghz RSSI threshold        : -60 dBm
  6Ghz transition minimum 5Ghz RSSI threshold          : -70 dBm

WLAN Configuration Information

WLAN Profile Name                     11k Neighbor Report       11v BSS Transition        
-----------------------------------------------------------------------------------------
1    Public Wi-Fi                     Disabled                  Enabled                   
5    Public Wi-Fi (6G)                Disabled                  Enabled                   

Here is the output of `show wlan wlan-id` for WLAN ID 5. This is the WLAN which clients get put onto via OWE transition from WLAN ID 1:

WLAN Profile Name     : Public Wi-Fi (6G)
================================================
Identifier                                     : 5
Description                                    : 
Network Name (SSID)                            : Free_WiFi (6G)
Status                                         : Disabled
Broadcast SSID                                 : Disabled
Advertise-Apname                               : Disabled
Universal AP Admin                             : Disabled
Max Associated Clients per WLAN                : 0
Max Associated Clients per AP per WLAN         : 0
Max Associated Clients per AP Radio per WLAN   : 200
OKC                                            : Enabled
Number of Active Clients                       : 0
CHD per WLAN                                   : Enabled
WMM                                            : Allowed
WiFi Direct Policy                             : Disabled
Channel Scan Defer Priority:
  Priority (default)                           : 5
  Priority (default)                           : 6
Scan Defer Time (msecs)                        : 100
Media Stream Multicast-direct                  : Disabled
CCX - AironetIe Support                        : Disabled
Peer-to-Peer Blocking Action                   : Disabled
Configured Radio Bands
      5ghz                                     : Enabled
      Slot                                     : Enabled on all slots
      6ghz                                     : Enabled
Operational State of Radio Bands
      5ghz                                     : UP
      Slot                                     : Enabled on all slots
      6ghz                                     : UP
DTIM period for 802.11a radio                  : 1
DTIM period for 802.11b radio                  : 1
Local EAP Authentication                       : Disabled
Mac Filter Authorization list name             : Disabled
Mac Filter Override Authorization list name    : Disabled
Accounting list name                           : 
802.1x authentication list name                : Disabled
802.1x authorization list name                 : Disabled
Security
    802.11 Authentication                      : Open System
    Static WEP Keys                            : Disabled
    Wi-Fi Protected Access (WPA/WPA2/WPA3)     : Enabled
        WPA (SSN IE)                           : Disabled
        WPA2 (RSN IE)                          : Disabled
        WPA3 (WPA3 IE)                         : Enabled
            AES Cipher                         : Enabled
            CCMP256 Cipher                     : Disabled
            GCMP128 Cipher                     : Disabled
            GCMP256 Cipher                     : Disabled
        Auth Key Management
            802.1x                             : Disabled
            PSK                                : Disabled
            CCKM                               : Disabled
            FT dot1x                           : Disabled
            FT PSK                             : Disabled
            FT SAE                             : Disabled
            Dot1x-SHA256                       : Disabled
            PSK-SHA256                         : Disabled
            SAE                                : Disabled
            OWE                                : Enabled
            SUITEB-1X                          : Disabled
            SUITEB192-1X                       : Disabled
    SAE PWE Method                             : Hash to Element, Hunting and Pecking(H2E-HNP)
    Transition Disable                         : Disabled
    CCKM TSF Tolerance (msecs)                 : 1000
    OWE Transition Mode                        : Enabled
    OWE Transition Mode WLAN ID                : 1
    OSEN                                       : Disabled
    FT Support                                 : Disabled
        FT Reassociation Timeout (secs)        : 20
        FT Over-The-DS mode                    : Disabled
    PMF Support                                : Required
        PMF Association Comeback Timeout (secs): 1
        PMF SA Query Time (msecs)              : 200
    Web Based Authentication                   : Disabled
    Conditional Web Redirect                   : Disabled
    Splash-Page Web Redirect                   : Disabled
    Webauth On-mac-filter Failure              : Disabled
    Webauth Authentication List Name           : Disabled
    Webauth Authorization List Name            : Disabled
    Webauth Parameter Map                      : Disabled
Band Select                                    : Disabled
Load Balancing                                 : Disabled
Multicast Buffer                               : Disabled
Multicast Buffers (frames)                     : 0
IP Source Guard                                : Disabled
Assisted-Roaming
    Neighbor List                              : Disabled
    Prediction List                            : Disabled
    Dual Band Support                          : Disabled
IEEE 802.11v parameters
    Directed Multicast Service                 : Enabled
    BSS Max Idle                               : Enabled
        Protected Mode                         : Disabled
    Traffic Filtering Service                  : Disabled
    BSS Transition                             : Enabled
        Disassociation Imminent                : Disabled
            Optimised Roaming Timer (TBTTS)    : 40
            Timer (TBTTS)                      : 200
        Dual Neighbor List                     : Disabled
    WNM Sleep Mode                             : Disabled
802.11ac MU-MIMO                               : Enabled
802.11ax parameters
    802.11ax Operation Status                  : Enabled
    OFDMA Downlink                             : Enabled
    OFDMA Uplink                               : Enabled
    MU-MIMO Downlink                           : Enabled
    MU-MIMO Uplink                             : Enabled
    BSS Target Wake Up Time                    : Enabled
    BSS Target Wake Up Time Broadcast Support  : Enabled
802.11 protocols in 2.4ghz band
    Protocol                                   : dot11bg
Advanced Scheduling Requests Handling          : Disabled
mDNS Gateway Status                            : Gateway
WIFI Alliance Agile Multiband                  : Disabled
Device Analytics
    Advertise Support                          : Enabled
    Advertise Support for PC analytics         : Enabled
    Share Data with Client                     : Disabled
Client Scan Report (11k Beacon Radio Measurement)
    Request on Association                     : Disabled
    Request on Roam                            : Disabled
WiFi to Cellular Steering                      : Disabled
Advanced Scheduling Requests Handling          : Disabled
6Ghz Client Steering                           : Enabled
Locally Administered Address Configuration
    Deny LAA clients                           : Disabled
Latency Measurements Announcements             : Disabled

 Note the OWE transition is working fine - but clients never move to the 6GHz frequency band.

[Rich R]

We tested a single 9136 on loan from Cisco for 2 months at the end of last year, before we had to give it back at the beginning of this year.

Our observation (similar to yours) was that clients usually preferred the 5GHz over the 6GHz band.  We fed this back to the BU via our account team but the BU seemed unable/unwilling to explain it or assist at all and never engaged in trying to understand or troubleshoot it before we needed to return the AP to Cisco.

[JPavonM]

@David Albrecht  why do you want Guests on 6-GHz band? I do prefer to use that band for corporate users so they can get the best performance with low-to-none congestion.

[David Albrecht]

This is in a large bowl/arena style environment with several hundred 9136s all within earshot of each other, and we are seeing 90+% channel utilization across most 5GHz channels during events. We consistently have over 10,000 guests on the network and there's simply not enough airtime for all of them on 5GHz.

[eglinsky2012]

IMO - Don’t wait for Cisco and the vendors to fix this. It could be a while. Plus there are so few clients that are even 6GHz capable now, it probably won’t make a significant difference in this situation.

I wonder if any optimizations to 5 GHz can be made in the meantime. Are the 5 GHz radios in single 8x8 or dual 4x4 mode? What channel width?

Out of curiosity, how many APs vs seats are there? Are they internal omni or external antennas? If external, then what antenna model(s)?

[Leo Laohoo]

---

@David Albrecht wrote:
we are seeing 90+% channel utilization across most 5GHz channels during events.

---

Are you using 20-, 40-, 80-, 160 Mhz channel bond?

Create an SSID for 6 Ghz only.  

[Scott Fella]

My two cents is keep the 6GHz separate from 2.4GHz and 5GHz.  Client steering is still dependent on the client, just like how it is for the 5GHz client steering.  Everyone has a different environment and different requirements, but if you separate the 6GHz and create a new SSID, it's a different band.  I still see wireless environments that have separate guest for 2.4GHz and 5GHz, so why not add a 6GHZ.

[Rich R]

That's fine for me at home and in small controlled environments but for public WiFi where corporate and brand are involved it's not an option - there can only be 1 SSID and the band must be transparent to the end user.

[Scott Fella]

It's different for me.  We always had that "requirement", but with 6GHz, things have changed for us and that is why I say that, "it's different for everyone".  Cisco has also mentioned to not use transition if you can.  Now if you enabled transition and client load balancing isn't working they way folks expect it to work, at least its implemented and maybe on day, devices will choose 6GHz vs the others.  I do get where you are coming from.

[Scott Fella]

I just tested this out following the same guide and also trying to tweak some settings.  On am iPhone 15 and Samsung S21, these devices only transition to "OWE_Transition" SSID but only on the 5GHz.  It doesn't matter how close the device is to the AP.  If I broadcast the SSID "OWE_Transition" and connect to that, well then I'm on 6GHz.  So in your case, it would make sense to create a Free_WiFi_6GHz also, that way devices that support 6GHz will see that SSID and most likely will connect to that.  Your Free_WiFi SSID will still be available to non 6GHz clients.

Why not get your Cisco team involved to help out?  I do this all the time when I run into odd things.

Listen also to what the others have mentioned... try to optimize what you also have.   You can't depend on features to just work.