WGB connection problem: Too many retries

[Christian Faessler]

We are using AIR-SAP702I-E-K9 and AIR-SAP1602I-E-K9 in WGB mobile-station mode with EAP-TLS authentication and we are having serious connection problems with this setup.

After a couple of minutes the WGB disconnects from the parent AP due to 'too many retries' even it is located only 2m away from the parent and the sigal strength is excellent.

AP1#sh dot11 asso all
 Signal Strength   : -31  dBm           Connected for    : 15 seconds
 Signal to Noise   : 67  dB            Activity Timeout : 6 seconds

This is not very nice of course. But as long as the WGB connects back to the 'good' parent (AP1) it isnt the real problem yet.

 Apr 30 13:23:34.378: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Too many retries
 Apr 30 13:23:35.522: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP1 [EAP-TLS WPAv2]
 Apr 30 13:32:05.718: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Too many retries
 Apr 30 13:32:07.950: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP1 [EAP-TLS WPAv2]

Sometimes the WGB decides to connect to a parent AP which is far away and has a very weak signal.

AP2#sh dot11 asso all
 Signal Strength   : -73  dBm           Connected for    : 4 seconds
 Signal to Noise   : 22  dB            Activity Timeout : 13 seconds

 Apr 30 13:57:55.758: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Too many retries
 Apr 30 13:57:56.190: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP2 [EAP-TLS WPAv2]
 Apr 30 13:58:01.430: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Signal strength too low
 Apr 30 13:58:01.474: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP2 [EAP-TLS WPAv2]
 Apr 30 13:58:01.474: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Too many retries
 Apr 30 13:58:01.910: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP1 [EAP-TLS WPAv2]
 Apr 30 14:02:15.759: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Too many retries
 Apr 30 14:02:21.239: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP2 [EAP-TLS WPAv2]
 Apr 30 14:02:21.431: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Signal strength too low
 Apr 30 14:02:21.855: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP1 [EAP-TLS WPAv2]
 Apr 30 14:05:08.763: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Too many retries
 Apr 30 14:05:09.183: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP2 [EAP-TLS WPAv2]
 Apr 30 14:05:14.431: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Signal strength too low
 Apr 30 14:05:14.855: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP1 [EAP-TLS WPAv2]
 Apr 30 14:09:24.775: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Too many retries
 Apr 30 14:09:25.195: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP3 [EAP-TLS WPAv2]
 Apr 30 14:09:29.439: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Too many retries
 Apr 30 14:09:29.999: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP1 [EAP-TLS WPAv2]
 Apr 30 14:13:22.779: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Too many retries
 Apr 30 14:13:23.199: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP2 [EAP-TLS WPAv2]
 Apr 30 14:13:28.439: %DOT11-4-UPLINK_DOWN: Interface Dot11Radio0, parent lost: Signal strength too low
 Apr 30 14:13:28.875: %DOT11-4-UPLINK_ESTABLISHED: Interface Dot11Radio0, Associated To AP AP1 [EAP-TLS WPAv2]

The interface config has been tuned as follows:

 interface Dot11Radio0
  no ip address
  no ip route-cache
  !
  encryption mode ciphers aes-ccm
  !
  ssid <SSID>
  !
  antenna gain 0
  speed  basic-11.0 12.0 18.0 24.0 36.0
  power local 9
  packet retries 128
  station-role workgroup-bridge
  mobile station scan 2412 2437 2462
  mobile station ignore neighbor-list
  mobile station period 5 threshold 70
  bridge-group 1
 end

We have already tried different IOS versions but this did not change the situation.

This all hapens when the WGB is stationary and very close to a parent AP. If we move the WGB through the facility the problem gets even worse...

Does anybody have an idea what could help in this situation?

Any feedback will be much appreciated.

Tnx, Christian

[David Watkins]

Hi Christian,

You may want to try a less lengthy packet retries count.  Typically this is at 32 by default and depending upon the type of application you're using (ie. NON stateful or real-time), you might try adding the "drop-packet" command to the end of your retries statement.

packet retries 32 drop-packet

This means the AP will simply drop the packet it is retrying and move on to the next one, rather than dis-associating from it's parent.

I would also reduce the sensitivity of your mobile station configuration; strength and frequency.  -70 RSSI is still more than good in a typical WGB application and your logs show you're getting a "signal strength too low" indication.  You may try pushing this down closer to -80.  Depending upon the conditions of the environment, you may be hitting this threshold quite often, leading to excessive scanning. From link below and to note: 

"The time should not be lower that what the WGB takes to complete an authentication process in order to prevent a "roaming loop" in some conditions or to avoid a too aggressive roaming behavior. In general, it should be tested to see what accomodates the application needs."

Since you're using EAP-TLS you may consider a less aggressive timer.

mobile station period 10 threshold 80

With this command I would suggest you also set a minimum data rate, such that rate shifts between higher data rates won't cause a pre-mature scan.  I would also suggest keeping your higher data rates enabled; you're missing 48 and 54.

Old but useful link for WGB advanced parameters

http://www.cisco.com/c/en/us/support/docs/wireless/aironet-1130-ag-series/113198-wgb-roam-config.html

"The RSSI level is expresed as a positive integer, although it is basically a normal -dBm measured level. You should use a sightly higher number than the minimum needed to keep your data rate working properly. For example, if your desired minimum rate is 6 mbps, a threshold RSSI of -87 should be sufficient. For a 48 mbps, you need -70 dBm, etc.

Note: This command can also trigger a "roaming by data rate change", which is too aggresive. It must be used together with minimum-rate for good results.

[oscarniemi]

>Sometimes the WGB decides to connect to a parent AP which is far away and has a very weak signal.

This is unfortunately by design when using mobile station period command.

From https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/111902-outdoor-mobi-guide-00.html

>A normal scan begins on the associated channel and continues to cycle through the rest of the channels.

>The WGB performs a fast scan when traffic is between 10 and 20 packets per second. The WGB scans and associates to the first responding AP during a fast scan.