WLC 5760 client issues

[hammelfr]

Hi,

we have a wireless setup with a HA-Pair of 5760 serving 8 WLANs via 3702APs. One of the WLANs is using WPA2-PSK with MAC-filtering. Now I'm facing the problem that some sort of clients are not reachable via the 5760. Looking at the controller they are associated, but I'm not able to ping these clients. The affected clients are using static IPs. The same clients are working fine via our old WLAN infrastructure based on Cisco WISM controllers.

For a test I disabled MAC filtering on the WLAN but that didn't help.

Any ideas ?

[mmunozrosas]

are you using "DHCP Address Assignment required" ? from Advanced Wlan configuration

Best Regards

Marco Muñoz

[hammelfr]

No - this feature is disabled. The WLC 5760 is running XE 3.3.3

any other ideas ? 

[patoberli]

If those clients are absolutely silent after they have connected, their ARP table entries in your router age out. Thus they will not anymore be reachable. Now normally the subnet responsible router would make a broadcast to discover those clients and server the packets, if the clients replies. Can you check if it is an ARP issue?

[hammelfr]

our arp cache is 4 hours - but I face the problem immediately in the moment the clients roam from the old WLC/AP to the new WLC/AP 

After I ping the client from the new WLC it is also reachable from the LAN

that's why I think it is not an ARP issue

[patoberli]

I don't have such a controller, but can you enable the debug log for the roaming? I don't know the exact command and you should only do it on a low usage controller. Maybe you can also debug the client once it's connected/roamed, but before you pinged it?

Also the current release is now 3.3.5SE which contains quite a few fixes.

Is the mobility-group correctly configured?

Is the client remaining in the same VLAN in the same network segment when it roams?

Do you use Flex Connect?

[hammelfr]

today I activated the feature "passive client" for the affected WLAN - this seems to improve the situtation - at least I can now reach the clients after pinging the clients directly from the controller - I don't understand why I have to ping the clients from the controller before I can reach them from the LAN

Any ideas ?

[Viten Patel]

are they in 'RUN' state? can they pass traffic normally?