Wireless clients sporadically getting Limited Connectivity, APs dropping packets

[John_Rowler]

We have a pair of V2110 wireless controllers and around 400 3825i access points. Controller firmware is 09.21.06.0002. AP firmware is 9.21.27.1387X.

About 4 months ago we noticed a problem where the APs would just drop traffic. A packet capture will show a ping coming into the radio from the client, going out the Eth interface on the AP, the reply coming back into the Eth interface, and never going out of the radio.

A particularly strange detail is that this only happens with certain source/destination traffic. For instance a client cant ping the gateway of 10.1.20.1/24. but cannot pint the server at 10.1.20.2. Since we can see the ping making it to the server and the ping reply making it back to the AP, we know it's not a firewall/ACL/routing issue on any other part of the network. The traffic disappears at the AP. Clients cannot communicate with anything on the Internet or any of our servers (DNS, DHCP, etc.) during this time. They can ping gateways in any subnet but that's it; everything else is failed.

More details:

-We've gone through several firmware updates with GTAC. Nothing has helped.
-The issue can affect any client on any AP in any location at any time.
-The issue is intermittent; it may happen every few minutes or once per month to a particular client in a particular area. Once failed it may last for seconds or days.
-While it's affecting one client, other clients on the AP may be working fine or may also fail.
-It can happen on either 2.4 or 5.7GHz.
-It can affect any type of client (phone, laptop, tablet) and any OS.
-Restarting the client or AP will sometimes fix the issue, sometimes not.
-It happens with our without using NAC, or any other type of authentication. It happens on completely open networks as well.
-It happens on both bridged at AP and bridged at controller topologies.
-It's not limited to a particular subnet or VLAN.
-It happens with or without Flexible Client Access enabled.
-It happens on either controller.
-GTAC hasn't made much progress on the issue in 4 months.

[Andre_Brits_Kan]

Do you think the timeout values will also help in the case where we use a preshared key and not 802.1x?

We have two wireless services, one with 802.1x and another with a preshared key.

Users on the 802.1x cant connect exactly like you mentioned - I will play with the timers.
Users on the preshared key also stops tx data until they disconnect and reconnect - do you think the timers will help with this as well?

Thx

[FES]

Andre,
yesterday we have modified de Session-Timeout value on radius (freeradius v2) with 1800 seconds, and today we dont have this desconnections... also we have modified de value en timeout values at the controller in the wlan service configuration (avanced button).

[Doug]

https://gtacknowledge.extremenetworks.com/articles/Q_A/How-to-adjust-the-client-timers-on-the-Identi...

5,30,0...

Idel timer checks for packets. No packets sent in X amount of time, remove the client from the controller.
RADIUS Session-Timeout is similar to the Session Timeout value in the advanced tab, but it will kick the client off at X value regardless if it's idle or not. The client would then need to reconnect and start the authentication process over. Be aware that some clients once kicked may roam over to a different network if the client has already been attached previously (like a guest SSID).

[FES]

Thanks Doug,
one quuestion?
what are the recommendations for wlan "service -> avanced " for timeout group? The timeout sesion is 0 seconds. Is this variable 'connected' with the session-timeout option of radius configuration?

[Doug]

Are you using a bridge at ap topology? If so can you capture an eth0 trace on the AP and get it to GTAC for review?

https://gtacknowledge.extremenetworks.com/articles/How_To/Using-Real-Capture-to-capture-wireless-tra...

Also one other thing to take a look at...
https://gtacknowledge.extremenetworks.com/articles/Q_A/What-are-the-best-radio-settings-for-my-envir...