topic Re: AP650 Troublesome ipads on PPSK in Aerohive Migrated Content

AP650 Troublesome ipads on PPSK

cforrest — Wed, 11 Dec 2019 19:04:44 GMT

We have a very odd scenario, we have a number of AP250s in our office all on 40mhz at 5ghz, we have recently introduced an AP650 with one int enabled on ac 20mhz @5ghz. With the theory to migrate all others soon to 20Mhz. On this AP and all others we have 3 SSID's the third is a PPSK network, we can see 1 client can connect to this but no others can, but we know the policy allows concurrent clients using the same key, when you walk out of this area the ipads connect fine. on all other APs AP250 on 8.4r10a, this is AP650 on the newest code. The other SSIDs however on the AP650 code 10.0r7a work with no issue.

I am purplexed to why this is. This quirk is very odd. Any suggestions would be welcome.

Re: AP650 Troublesome ipads on PPSK

ashley_finch — Wed, 11 Dec 2019 20:21:57 GMT

Is the 650 on the same MGT IP as the AP250s? If you do a "show IDM" and "exec aaa idm-test radsec-proxy" what do you get back?

Re: AP650 Troublesome ipads on PPSK

cforrest — Wed, 11 Dec 2019 20:32:46 GMT

#show idm

IDM client: Enabled Per SSID

IDM Proxy IP: 10.0.137.126

IDM proxy: Disabled

RadSec Certificate state: Valid

RadSec Certificate Issued: 2019-11-22 08:25:33 GMT

RadSec Certificate Expires: 2020-11-21 08:25:33 GMT

exec aaa idm-test radsec-proxy

The Aerohive device establish a TCP session with the ID Manager auth gateway successfully.

Re: AP650 Troublesome ipads on PPSK

cforrest — Wed, 11 Dec 2019 20:33:11 GMT

Also the MGT IIP range is the same as the AP250s

Re: AP650 Troublesome ipads on PPSK

cforrest — Wed, 11 Dec 2019 20:42:36 GMT

It seems to behave like when we originally setup the policy, when the PPSK user was limited to 1, now it is 0, like it it just ignores your request as it has one device attached to it, thats the only conclusion I can see, like re enter this on the command line although this is the default >>security private-psk same-user-limit 0 , the output on this object shows no value which I assume is the default which is 0

Re: AP650 Troublesome ipads on PPSK

ashley_finch — Thu, 12 Dec 2019 00:44:16 GMT

I presume you're getting an incorrect password message when you try to connect another device on the same PPSK?

What if you enter '_debug auth basic', try to connect to the AP, enter 'show log buf', what are you seeing from the AP when the client tries to connect?

Re: AP650 Troublesome ipads on PPSK

cforrest — Thu, 12 Dec 2019 00:50:23 GMT

The policy for the password is sent to all of our ipads through MDM so they all have the same, when you walk away from the AP650 to an AP250 it joins fine, wondering if the AP650 is not allowing multiple connections on the PPSK policy ?

Re: AP650 Troublesome ipads on PPSK

ashley_finch — Thu, 12 Dec 2019 00:57:43 GMT

I see, so is it just "spinning" as such when it tries to join the SSID? Seeing a reason in the buffered log of the AP may help, alternatively are you seeing anything in the client logs when you search the MAC of an iPad in ExtremeCloud IQ?

Re: AP650 Troublesome ipads on PPSK

cforrest — Thu, 12 Dec 2019 00:59:40 GMT

It spins then says incorrect password which it clearly isnt, which totally odd, given one ipad joins and the others have the same policy...even when i try on my iphone etc

Re: AP650 Troublesome ipads on PPSK

cforrest — Thu, 12 Dec 2019 01:01:13 GMT

But i can see what you are thinking

Re: AP650 Troublesome ipads on PPSK

cforrest — Thu, 12 Dec 2019 17:43:26 GMT

Hi again, so since yesterday I have done exactly your thinking and I can something quite odd, it seems as though the clients which cannot connect to this particular SSID

The odd thing here is 1.4 is not enabled I only have 0.4 enabled for this SSID

>> NCL2-AP369#show logging buffered

2019-12-12 09:35:08 info ah_cli: security: admin:<show logging buffered >

2019-12-12 09:35:02 info kernel: [wifi]: [CLT_CAPS]wifi1.4: Add scb<4c:32:75:4f:16:7b>, waiting its probe req frame 1

2019-12-12 09:35:02 info ah_dcd: wifi: [CLT_CAPS]Send 3485:841f:8467[4c32:754f:167b] <ASSOC REQ> trap successfully

Re: AP650 Troublesome ipads on PPSK

cforrest — Thu, 12 Dec 2019 18:54:04 GMT

Since a reboot early indications look good