topic Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process in Network Architecture & Design

Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

Lane_Messer — Wed, 04 Nov 2020 21:38:50 GMT

Hello!

We are using Extreme Management Center 8.4, V2110 Medium 10.41, Extreme Networks Access Control Engine 8.4, and VMWare 6.5.

For whatever reason, when a client connects to the captive portal and signs in correctly. It will stay there for 5 or 10 minutes unless we force authentication on Management Center. Of course, they get in the quarantine vlan which is 172.x.x.x, but once forced, they get into the correct vlan 10.x.x.x.

Not really sure what’s going on. I can’t follow the last solution in the article that includes the same title, because I cannot find that in Management Center.

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

StephanH — Thu, 05 Nov 2020 00:09:17 GMT

Hello Lane,

are you talking about this article?

https://gtacknowledge.extremenetworks.com/articles/Solution/Wireless-client-registering-to-NAC-and-flipping-VLAN-is-slow-to-get-new-IP-address-causing-delay-in-registration-process

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

Lane_Messer — Thu, 05 Nov 2020 00:21:49 GMT

Yes I am, but unfortunately cannot find anything on our controller that’s close to step 2. Not sure where to go from here.

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

StephanH — Thu, 05 Nov 2020 00:29:37 GMT

Hello,

step 2 (Disable Change of Authorization on NAC ) is no a controller but a NAC setting.

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

Lane_Messer — Thu, 05 Nov 2020 01:35:47 GMT

Sorry for replying to your response in-full.

However, even disabled, it still takes the client forever to switch over to the VLAN with internet. Around 2 minutes and it will eventually switch. Despite showing that network access was granted, the client still has a 172.x.x.x address.

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

StephanH — Thu, 05 Nov 2020 02:35:20 GMT

Hello Lane,

to be sure:

172.x.x.x is the ip from the network where you redirected to the portal page

10.x.x.x is the ip network where you are should be connected if you are signed in and authenticated.

If this is correct and you still remain in the 172.x.x.x network although your can see the policy your client receive (check controller client reports for that). I assume you leastime is to long.

Your client will not be informed after the network change that it has to change the IP. This is normal!
You have to set the leasetime in network 172.x.x.x very short. E.g. 30 seconds to make the client change the IP faster, You can play with the leasetime to find out the best timerange for your needs.

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

Lane_Messer — Thu, 05 Nov 2020 02:42:41 GMT

@StephanH

172.x.x.x is the quarantine vlan.

10.x.x.x is our internet vlan

Devices that are in unregistered get redirected to our captive portal at 10.33.x.x, which is the IP of the NAC.

Once they login, they sit there in the quarantine vlan for a few minutes unless I disassociate their device on the V2110 or force reauthentication and scan on Management Center.

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

Lane_Messer — Thu, 05 Nov 2020 03:24:23 GMT

If I disassociate in the V2110, they automatically get connected.

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

Brian_Anderson1 — Thu, 05 Nov 2020 03:31:13 GMT

I try to avoid flipping vlans on wireless, it just doesn’t consistently work well, especially for Apple devices.

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

Lane_Messer — Thu, 05 Nov 2020 05:07:13 GMT

Still doesn’t really help.

What is weird is if I go into the V2110 and find the client, disassociate it, it will automatically connect (providing I enter the right credentials in the captive portal first.)

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

Brian_Anderson1 — Thu, 05 Nov 2020 05:24:02 GMT

Just giving you my experience. I’ve done all you have done and still no joy. Apple for some reason doesn’t accept the disassociate packet that it is sent, and never releases its hold on the wireless signal so that it can associate and obtain the new ip address. Not sure what devices you have tested with, but for me Android and Windows works well, Apple doesn’t.

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

StephanH — Thu, 05 Nov 2020 14:53:21 GMT

Hello Lane,

can you post your quarantine rule? When shouled devices go to the quarantine rule and network?

If I understand you correct, the unregistered vlan and the internet vlan is the same, correct?

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

Lane_Messer — Thu, 05 Nov 2020 21:26:18 GMT

Well, everything was working fine last week.

We did just go through a time change, but I’m not sure that matters.

Basically, now users can login on the captive portal, but I have to go into the V2110, find the AP they’re on, and click dissociate before they can successfully connect. It will tell them they are granted network access, but the page will never refresh and the client will not connect.

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

Lane_Messer — Fri, 06 Nov 2020 00:35:04 GMT

I am receiving this error on the NAC when attempting to re-authenticate.

[com.enterasys.tesNb.server.snmp.reauthentication.DisconnectMessageReauthenticationWorker] (Reauthentication Service Thread19:) Unable to update the authorization level for MAC: 00-1E-4C-9A-CB-47, IP: 172.16.222.64 because of exception:java.lang.NullPointerException

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

Ovais_Qayyum — Sat, 07 Nov 2020 10:11:09 GMT

Hi Lane,

This looks like a CoA problem.

In this case, the symptom you would see are:

1- Client connects to the Captive Portal, CP appears just fine and the user can complete the registration.

2- The CP page stays on “you have been successfully granted network access” and right after that the device gets disconnected (it may or may not get disconnected).

3- On the NAC you see the client device with the correct policy role after successful registration e.g. Guest Access role.

4- Client device never gets an IP from Guest Access Vlan.

5- If you manually disconnect the client device and reconnect it, it connects just fine and acquires an IP address too. It's because CoA is not working and when you manually disassociate a client and reassociate it back, it kinda mimics the CoA process but in a manual fashion.

Things you check and possible fixes:

1- Verify if the time is correct on both controller and the NAC, the recent DST change over last weekend could have changed time by an hour. A time difference of five minutes or more will cause the CoA packets to be discarded by the controllers silently.

2- If the time is correct, look for DAS (Dynamic Authorization) related error messages in the controller log. You may see something like “Dynamic Authorization Service Decoding failed”.

3- You can run a TCPDUMP on the NAC to see if it’s getting anything back from the controller in response to CoA request packet. If no CoA ACK packets are seen from the controller end, this would confirm that DAS is busted which in turn will cause CoA to stop working. Use the following article to run TCPDUMP, you can analyze the pcap file in Wireshark.

https://gtacknowledge.extremenetworks.com/articles/How_To/NAC-Troubleshooting-Tips-common-tcpdump-commands-used-for-isolating-issue?q=nac+tips

3- Create a new AAA policy and assign it to the controller, delete the old one.

Let me know if that helps, otherwise we will try some other stuff.

Regards,

Ovais

Re: Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

Lane_Messer — Mon, 09 Nov 2020 21:10:45 GMT

Hello, thank you so much for your help. However, the java error that was posted is an issue in version 8.4 of Extreme Networks Access Control.

The cause of the issue is due to changing re-authentication on the Access Controller.

The unofficial workaround is to enforce using Java NAC Manager. However, that doesn’t fix the issue.

Upgrading both Extreme Networks Management Center and Extreme Networks Access Control to 8.5 corrected the issue entirely.