Wireless client registering to NAC and flipping VLAN is slow to get new IP address causing delay in registration process

[Lane_Messer]

Hello! 

We are using Extreme Management Center 8.4, V2110 Medium 10.41, Extreme Networks Access Control Engine 8.4, and VMWare 6.5. 

For whatever reason, when a client connects to the captive portal and signs in correctly. It will stay there for 5 or 10 minutes unless we force authentication on Management Center. Of course, they get in the quarantine vlan which is 172.x.x.x, but once forced, they get into the correct vlan 10.x.x.x. 


Not really sure what’s going on. I can’t follow the last solution in the article that includes the same title, because I cannot find that in Management Center.

[Lane_Messer]

@StephanH 

172.x.x.x is the quarantine vlan. 

10.x.x.x is our internet vlan

Devices that are in unregistered get redirected to our captive portal at 10.33.x.x, which is the IP of the NAC. 

Once they login, they sit there in the quarantine vlan for a few minutes unless I disassociate their device on the V2110 or force reauthentication and scan on Management Center. 

[StephanH]

Hello Lane,

to be sure:

172.x.x.x is the ip from the network where you redirected to the portal page

10.x.x.x is the ip network where you are should be connected if you are signed in and authenticated.

If this is correct and you still remain in the 172.x.x.x network although your can see the policy your client receive (check controller client reports for that). I assume you leastime is to long. 

Your client will not be informed after the network change that it has to change the IP. This is normal!
You have to set the leasetime in network 172.x.x.x very short. E.g. 30 seconds to make the client change the IP faster, You can play with the leasetime to find out the best timerange for your needs.

[Lane_Messer]

Sorry for replying to your response in-full. 

However, even disabled, it still takes the client forever to switch over to the VLAN with internet. Around 2 minutes and it will eventually switch. Despite showing that network access was granted, the client still has a 172.x.x.x address. 

[StephanH]

Hello,

step 2 (Disable Change of Authorization on NAC ) is no a controller but a NAC setting.

[Lane_Messer]

Yes I am, but unfortunately cannot find anything on our controller that’s close to step 2. Not sure where to go from here.