topic RE: Slow passthrough RADIUS request VX9000 in ExtremeWireless (WiNG)

Slow passthrough RADIUS request VX9000

Erwin — Mon, 08 Jan 2018 19:30:00 GMT

Hi all,

We use a VX9000 with 1200+ AP7522.
RADIUS requests go to a Aruba RADIUS server.
The Proxy mode for RADIUS requests is: "through-centralized-controller" so the VX9000 sends the requests to the RADIUS server.

In a attempt to use a captive portal to authenticate guest users on a guest vlan we noticed that there is a lag.
It takes the VX9000 a minimal of 50 seconds to send the request after the user entered his user/password.

Can anyone shed a light on this. We are stuck.

RE: Slow passthrough RADIUS request VX9000

Andrew_Webster — Mon, 08 Jan 2018 21:08:00 GMT

Just a thought, but how have you defined the hosts in the AAA policy?
If by hostname, maybe its a DNS failure of some sort?
If by IP address, is the RADIUS server attempting to do some sort of reverse-IP lookup and that is failing?
Have you taken some packet captures at the AP and the VX to see the progression of the RADIUS messages to identify where it is slowing down?

RE: Slow passthrough RADIUS request VX9000

Erwin — Mon, 08 Jan 2018 21:08:00 GMT

thanks Andrew for your response.
Host is in IP.
We see in packet capture a direct response from the RADIUS server so a reverse lookup is not likely.
After entering the name/password packet capture reveales a delay in the VX9000 before it sends an access-request to the RADIUS.
Packet capture between AP and VX is mint traffic wich is hard to encypher.

RE: Slow passthrough RADIUS request VX9000

Andrew_Webster — Mon, 08 Jan 2018 21:08:00 GMT

You might want to have a look at 'service show process' cli to see if something is maxing out the CPU on the VX and it is slow to respond, also check 'show event-history' and 'show logging' to see if any errors are getting logged.

RE: Slow passthrough RADIUS request VX9000

Erwin — Mon, 08 Jan 2018 21:08:00 GMT

Thanks Andrew,
Two commands where new to me.
I had the same idea. I build an extra VX9000 controller to check if there is a resource problem. (not expecting that, we have a VX9000 with enough oempf to run nsight but it is still off). Only need to adopt our test AP's.

RE: Slow passthrough RADIUS request VX9000

Doug — Mon, 08 Jan 2018 21:08:00 GMT

Erwin,

How are you making out with this issue? Are you all set at this point?

RE: Slow passthrough RADIUS request VX9000

Erwin — Mon, 08 Jan 2018 21:08:00 GMT

Hello Doug,

Thank you for asking and sorry i did not respond earlier.

Status:
We updated our AP's to 5.8.6.8 and used the extra VX9000 which has a minimal amount of adopted AP's. We stil have the slow response.

We used the toubleshoot / Debug Captive Portal Clients.
That gave us no new knowledge.

show event-history
gives only the association and authentication info.

Nothing in the log.

I am out of options. 😞

RE: Slow passthrough RADIUS request VX9000

Doug — Mon, 08 Jan 2018 21:08:00 GMT

Have you opened a ticket with GTAC? That's probably the next step here.

Thanks,
Doug

RE: Slow passthrough RADIUS request VX9000

Erwin — Thu, 03 May 2018 14:45:00 GMT

Solved:
For future reference:

There was a delay of 1 minute in the config of the Clearpass captive portal.
It was overlooked by us as well as the engineer of our seller.