Re: [WIRELESS-LAN] PoE Load Tester Recommendation

2021-09-09 Thread Ethan Grinnell
I wouldn't suggest hacking together anything to test PoE. It's way more
complicated than it seems like it would be. If your test device said that a
link failed would you really know if it was an issue with PoE/Cabling or
your device?

If you're looking for a cheap method, here's a PoE PD client evaluation PCB
from Analog Devices
https://www.analog.com/en/design-center/evaluation-hardware-and-software/evaluation-boards-kits/DC2911A.html.
At only $95 I doubt you'd find a cheaper solution that lets you adjust the
requested power. It's not automated and it's not even in an enclosure, but
it'd give you all you need to know that PoE is working. I've haven't used
one before, so I can't say for sure if it'd work out of the box, but it
looks like it should be good.

This Fluke seems good if you want an actual tester. It tests up to 90W
802.3af/at/bt and has a 10G interface. I have no experience with it either,
but Fluke always seems to make good products.
https://www.fluke.com/en-us/product/network-cable-testers/copper/linkiq-100

Ethan Grinnell
CCIE Enterprise Infrastructure  #39723, BS CmpE
Network Engineer
Office of Information Technology, Technology Infrastructure, Networking
Portland State University


On Wed, Sep 8, 2021 at 1:03 PM Neumann, Paul  wrote:

> I suspect some (non-trivial) time and tinkering would be needed to make
> this work.  I see a major issue is that all the flavors (classes) of POE
> require the devices to first complete a power negotiation phase where the
> endpoint requests the proper class of power needed.  Only then is power
> delivered to your resistance (properly sized for wattage with an
> appropriate heatsink).   Also power is delivered over the data lines for
> certain poe modes - you need to separate the baseline voltage from the data
> communication that is superimposed over that.  All the above should be
> achievable for anyone with a EE background.  I’m sure there is some level
> of devil in the details.
>
>
>
> This would be a cool senior project for an  upper level/grad student in
> electrical engineering but for serious work, I would just buy a fluke
> tester.
>
>
>
> Paul
>
> --
>
> Paul Neumann
>
> Lead Network Engineer
>
>
>
> Technology Solutions (formerly ACCC)
>
> Unversity of Illinois Chicago
>
>
>
> E: pa...@uic.edu
>
> P: (312) 355-0113
>
> Room 124, Benjamin Goldberg Research Center, University of Illinois at
> Chicago
>
> it.uic.edu
>
> Visit the UIC Help Center at help.uic.edu to find IT Services, Answers,
> and Support!
>
>
>
> *From:* The EDUCAUSE Wireless Issues Community Group Listserv [mailto:
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] *On Behalf Of *Beyerle, David Evan
> *Sent:* Wednesday, September 08, 2021 6:44 AM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] PoE Load Tester Recommendation
>
>
>
> Brad,
>
> Recall that P=V^2/R, so it seems as though applying the appropriately
> sized & load-rated resistance network across the pairs delivering power,
> and then measuring the voltage dropped across that resistance network would
> give you a reasonably good indication of whether the appropriate power is
> being delivered to the load.  For 60W in seems like you might choose R~75
> Ohm on each of two pair, but I’d encourage you to double-check my
> arithmetic.
>
> Best,
> Dave
>
> --
>
> *From:* The EDUCAUSE Wireless Issues Community Group Listserv <
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> on behalf of Floyd, Brad <
> bfl...@mail.smu.edu>
> *Sent:* Tuesday, September 7, 2021 5:43 PM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU <
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
> *Subject:* [WIRELESS-LAN] PoE Load Tester Recommendation
>
>
>
> Can anyone recommend a device to PoE load test network jacks? I have some
> jacks that pass the installer’s Category Certification, but are not passing
> the appropriate PoE to bring the APs online. I would like to be able to
> load test for 802.3af, 802.3at, and 802.3bt (at both 60W and 90W), as
> appropriate. I assume I would need to be able to set the load to apply (in
> Watts) and see the voltage level at the Powered Device. The usual
> constraints apply. Cheaper, but reliable is best.
>
> Thanks,
>
> Brad
>
>
>
> **
> Replies to EDUCAUSE Community Group emails are sent to the entire
> community list. If you want to reply only to the person who sent the
> message, copy and paste their email address and forward the email reply.
> Additional participation and subscription information can be found at
> https://www.educause.edu/community
> <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity=04%7C01%7

Re: [WIRELESS-LAN] Cisco WLC 9800 Gotchas

2020-12-15 Thread Ethan Grinnell
I spent some time tinkering with a 9105AXW in AireOS recently. It's
definitely not quite right and behaves differently than the 1810W/1815W. I
hope it just has buggy software that will be fixed in the future. I haven't
tried the wired ports in c9800 yet, I know that was the actual question.
I'll share my AireOS experience anyway.

In AireOS the regular RLAN configs* do* work 9105AXW, without any special
configs or CLI commands. All I had to do was reboot the AP after making any
AP group port config changes, just one reboot was all it needed. After
hours of troubleshooting and changing configs, that's all it ended up
being. From then on it works fine, as long as you don't change the port
configs. I didn't use port-override to enable the ports. Not sure if that's
helpful for c9800. If anything, I guess it just adds +1 to the sentiment:
"Something isn't right" with these APs.

Unrelated to 9105AXW, but regarding bulk configurations, I've been doing
most of it in Excel and pasting into the WLC. Lame, I know, but it works.
With the AP MAC addresses in the spreadsheet already, enter the building,
floor, room, distinguisher, and spits out all of the WLC commands for each
AP. Copy/paste the commands into a text editor, replace tabs with newlines,
and copy/paste into the WLC. The columns that are just "y" are because that
command wants you to confirm before it takes effect. Include that in what
you copy/paste. Here's what I've been using for AireOS config of a regular
AP. My naming convention is to use a hyphen to separate fields. The AP
model is prefixed with "AP" to differentiate between switches and other
things. The AP "Distinguisher" could be the AP number or the location in
the room (NW). The APs are named by Building-Floor-Room-Model-Distinguisher.

Substituting tabs to newlines, this line:

> config ap name BLDG-1-100-AP2802-NW 123456ABCDEE config ap location
> BLDG-1-100 BLDG-1-100-AP2802-NW config ap primary-base WLC-NAME
> BLDG-1-100-AP2802-NW 1.2.3.4 config ap group-name BLDG-1-APGROUP
> BLDG-1-100-AP2802-NW y config ap link-encryption enable
> BLDG-1-100-AP2802-NW y

Becomes:

> config ap name BLDG-1-100-AP2802-NW 123456ABCDEE
> config ap location BLDG-1-100 BLDG-1-100-AP2802-NW
> config ap primary-base WLC-NAME BLDG-1-100-AP2802-NW 1.2.3.4
> config ap group-name BLDG-1-APGROUP BLDG-1-100-AP2802-NW
> y
>
Wait for AP reboot, then paste the last blob

> config ap link-encryption enable BLDG-1-100-AP2802-NW
> y


Ethan Grinnell
CCIE Enterprise Infrastructure #39723, BS CmpE
Network Engineer
Office of Information Technology, Technology Infrastructure, Networking
Portland State University

>

**
Replies to EDUCAUSE Community Group emails are sent to the entire community 
list. If you want to reply only to the person who sent the message, copy and 
paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community


AP Configuration Template.xlsx
Description: MS-Excel 2007 spreadsheet


Re: [WIRELESS-LAN] ISE version

2020-12-10 Thread Ethan Grinnell
I asked one of our Cisco reps if he had any idea when we should consider
upgrading to 3.0. He'd been told that 2.7 is supposed to be a long lived
release. I think we'll be safe there for a while. He also said that they
like to only have 3 release trains in development.

I havent tried 3.0 yet, but 2.7 has been good so far.

Ethan Grinnell
CCIE R #39723, BS CmpE
Network Engineer
Office of Information Technology, Technology Infrastructure, Networking
Portland State University
503-725-3205

On Thu, Dec 10, 2020, 8:33 AM Christina Klam  wrote:

> All,
> We are running 2.6.0.156 version of ISE.We are scheduled to upgrade
> it over the Winter Break.
>
> I see that 3.0 is out.  The demos of it look great.   But it is not Safe
> Harbor yet.   2.7 is still the preferred version in cisco.com. We do
> not want to upgrade to 2.7 to only have to do it again in a month or so.
> But we also cannot risk to go bleeding edge and have eduroam stop working.
>
>
> Has anyone upgrade to 3.0 and can share their experience?
>
> Christina Klam
> Network Engineer
> Institute for Advanced Study
> 1 Einstein Dr
> Princeton, NJ 08540
> (m) +1 609-751-7899
> (o) +1 609-734-8154
> ck...@ias.edu
>
> **
> Replies to EDUCAUSE Community Group emails are sent to the entire
> community list. If you want to reply only to the person who sent the
> message, copy and paste their email address and forward the email reply.
> Additional participation and subscription information can be found at
> https://www.educause.edu/community
>

**
Replies to EDUCAUSE Community Group emails are sent to the entire community 
list. If you want to reply only to the person who sent the message, copy and 
paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community


Re: [WIRELESS-LAN] multi user windows/osx eap tls onboarding

2020-10-14 Thread Ethan Grinnell
You can configure the SecureW2 network profile to provision the device at
the system level instead of the user level. There are also a few other
changes needed so that the certificate is issued for the hostname instead
of the user. The user running the provisioning application needs to be a
super/admin user. The application won't prompt for elevation in Windows,
you just have to run as admin for it to complete without error. IIRC it
worked fine in macOS.

If this is for managed devices instead of BYOD, then there is a good chance
it already has a domain issued identity certificate (You mentioned
ADCS/GPO). I'm not certain, but I believe that I had a working SecureW2
policy that didn't actually issue a certificate, it just configured the
device to use an existing identity certificate. Take that with a grain of
salt though, it's been a year or so since I played with that, I may not be
recollecting correctly.

SecureW2 also has a Managed Device Gateway subscription that makes this
very easy. Instead of having a user go out and provision a device manually,
it automates the process. Of course, it's not free.

Unrelated to SecureW2 and WiFi, we recently completed a project that uses
ADCS issued identity certificates to perform AnyConnect authentication.
Managed Windows devices already had the certificate, but macOS devices had
a certificate issued by our jamf CA. To make the whole process simpler for
AnyConnect and the headend ASA, we added a policy for macOS devices that
has them obtain an additional identity cert from ADCS when the device is
provisioned by jamf (They have the jamf and ADCS ID certs). I wasn't
directly involved in the jamf configuration, but I believe that jamf acts
as a proxy and requests the cert from ADCS.

Ethan Grinnell
CCIE R #39723, BS CmpE
Network Engineer
Office of Information Technology, Technology Infrastructure, Networking
Portland State University


On Wed, Oct 14, 2020 at 12:21 PM Tim Cappalli <
0194c9ecac40-dmarc-requ...@listserv.educause.edu> wrote:

> For Windows 10, you can use TEAP with chained machine + user certs (or a
> mix of cert and legacy cred).
>
>
>
> For macOS, I’d recommend just using a machine identity, unless you
> absolutely need user identity for policy.
>
>
>
> tim
>
>
>
> *From: *The EDUCAUSE Wireless Issues Community Group Listserv <
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
> *Date: *Wednesday, October 14, 2020 at 15:15
> *To: *WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU <
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>
> *Subject: *[WIRELESS-LAN] multi user windows/osx eap tls onboarding
>
> For folks who onboard using eap tls.  What workflow or solution do you use
> for multiuser windows/osx devices?   We are using securew2 and this onboard
> process creates cert for that user who onboards the device.  Then when
> another user logs on they can’t connect to wireless because the cert isn’t
> for that user currently logged on.I can do machine auth via adcs and
> gpo that out for those but not sure how or what to do with osx multi user
>
>
>
> Thanks
>
> Trent
>
>
>
>
>
> **
> Replies to EDUCAUSE Community Group emails are sent to the entire
> community list. If you want to reply only to the person who sent the
> message, copy and paste their email address and forward the email reply.
> Additional participation and subscription information can be found at
> https://www.educause.edu/community
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.educause.edu%2Fcommunity=04%7C01%7Ctim.cappalli%40MICROSOFT.COM%7C25708c4323aa42f9544608d8707591a9%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637382997541534260%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000=VVSZQyXmPJsdgD1yHZyxm5q3MCPR%2BLuGaKR5umkeMLs%3D=0>
>
> **
> Replies to EDUCAUSE Community Group emails are sent to the entire
> community list. If you want to reply only to the person who sent the
> message, copy and paste their email address and forward the email reply.
> Additional participation and subscription information can be found at
> https://www.educause.edu/community
>

**
Replies to EDUCAUSE Community Group emails are sent to the entire community 
list. If you want to reply only to the person who sent the message, copy and 
paste their email address and forward the email reply. Additional participation 
and subscription information can be found at https://www.educause.edu/community


Re: [WIRELESS-LAN] Status of Wi-Fi 6 Client Drivers?

2020-09-23 Thread Ethan Grinnell
I recently wanted to do testing with an affected driver and was able to
obtain them on OEM websites instead of directly from Intel. This build has
the issue with WiFi6 SSID visibility:
https://support.lenovo.com/us/en/downloads/DS103594

Also, I noticed that the Windows 10 built-in driver for many Intel WiFi
chips is version 17.x (It was on my test client) which didn't seem to have
the issue. So that's fun, it's not just versions lower than some baseline
build number being affected. I didn't test many different builds, but it
looked like 17.x was good, 18.x, 19.x, and 20.x had some affected builds.
More information here:
https://www.intel.com/content/www/us/en/support/articles/54799/network-and-i-o/wireless.html

The issue is still around. Many BYOD types require users to update their
own drivers, which few seem to do. Windows doesn't always update the
drivers either, so there could potentially be lingering issues from
outdated drivers for a long time.

Ethan Grinnell
CCIE R #39723, BS CmpE
Network Engineer
Office of Information Technology, Technology Infrastructure, Networking
Portland State University


On Wed, Sep 23, 2020 at 2:01 PM Mike Atkins  wrote:

> We deployed our ax capable APs without ax enabled for the same Intel
> driver issues.  I wanted to test something with a flawed driver recently
> and noticed it is no longer available from Intel.  I think Intel revamped
> their downloads page at the end of last year to remove all but the newest
> revisions of drivers.   We use SecureW2 for eduroam onboarding so we can
> get a sense of drivers used by Windows devices.  We will probably enable
> Wi-Fi 6 next year if the numbers continue to look good.
>
>
>
>
>
>
>
>
>
> *Mike Atkins *
>
> Infrastructure Architect
>
> Office of Information Technology
>
> University of Notre Dame
>
> Phone: 574-631-7210
>
>
>
>
>
>    .__o
>
>- _-\_<,
>
>---  (*)/'(*)
>
>
>
>
>
> *From:* The EDUCAUSE Wireless Issues Community Group Listserv <
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> *On Behalf Of *Nadim El-Khoury
> *Sent:* Wednesday, September 23, 2020 4:41 PM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] Status of Wi-Fi 6 Client Drivers?
>
>
>
> Hi Eric,
>
>
>
> One more thing that I forgot to answer. We elected to keep Wi-Fi 6 enabled
> and just disabled it in the vicinity of our Technical Support Center (User
> Support) in the Library building.
>
>
>
> Best,
>
>
>
> Nadim
>
>
>
> On Wed, Sep 23, 2020 at 4:35 PM Floyd, Brad  wrote:
>
> Eric,
> I have deployed almost 200 of the Aruba 530 series APs so far in the last
> 2-3 months. I saw, first hand, what happens with the 802.11ax enabled SSID
> and the flawed Intel drivers. The SSIDs don't appear to those devices. When
> we were discussing whether or not to deploy the ax APs vs stick with ac
> APs, we decided we wanted the longer remaining life span before end-of-sale
> / end-of-support of the APs of the ax vs the ac. The added benefit Aruba
> provides is that it is very simple to disable the features (just a single
> check box on a profile). We figure we can wait for a semester or two and
> schedule an attempt to re-enable the features. A driver update definitely
> fixes the issue, but since we are so heavily loaded with BYOD devices that
> we have no control over, this was a better option for us. Hopefully this
> helps.
> Thanks,
> Brad
>
> -Original Message-
> From: The EDUCAUSE Wireless Issues Community Group Listserv [mailto:
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Kenny, Eric
> Sent: Wednesday, September 23, 2020 3:14 PM
> To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> Subject: [WIRELESS-LAN] Status of Wi-Fi 6 Client Drivers?
>
> Hi All,
>
> I know on-campus populations might not be what they usually are right now,
> but I was wondering if anyone has seen reports of buggy client side drivers
> causing issues with 802.11ax.  Specifically we are using the Aruba AP-530
> series AP.  There were some Intel chips that had challenges a few months
> back, but a driver update resolved the issue.
>
> We are considering disabling the Wi-Fi6 capability of the APs to prevent
> issues with outdated drivers, so we’d like to hear your observations so far
> if this is still a real problem.
>
> Thank you,
>
> Eric Kenny
>
> Network Architect | Infrastructure Technology Services Harvard University
> Information Technology
>
> **
> Replies to EDUCAUSE Community Group emails are sent to the entire
> community list. If you want to reply only to the person who sent the
> message, copy and paste their email address and forward the email reply.
> Additional participation 

Re: [WIRELESS-LAN] [External] [WIRELESS-LAN] Chromecasts and App on Phones

2020-01-27 Thread Ethan Grinnell
Hello,

Hrm, but it does work when the clients and Chromecast are on the same VLAN,
so it doesn't make sense to me that it'd be an issue with the IP address
being public.

I did a bit of tinkering with something along those lines. In our case we
have P2P blocking turned on and wanted to keep it that way. So I used 2
different SSIDs. One regular SSID for the phone, and a special SSID just
for the Chromecast. There are some quirks of P2P blocking on different
SSIDs. I'm going from memory here, so I may not be recalling 100%
correctly. I believe that if P2P blocking is enabled and the clients are on
different SSIDs *and* different VLANs, then packets aren't dropped by the
WLC, but are forwarded upstream (ASA firewall). The firewall has all WLAN
client VLAN/SVI's at the same security level and ASA drops
same-security-level traffic by default. So either allow same-security-level
traffic or give the interface for Chromecast devices a different security
level. That made it mostly work for me.

The only problems with what I did is that the app still wants the devices
on the same SSID for the config to "complete", but that's at the very end
of setup. The phone can be moved back to the regular SSID after setup is
completed and it still works. Also, having to switch SSIDs is confusing for
users.

You are using one SSID and multiple VLANs, so a bit different than what I
was doing, but I'm thinking that it's actually the FW dropping the traffic
that's causing the issue. See if one of those work arounds helps.

Regards,

Ethan Grinnell
CCIE R #39723, BS CmpE
Network Engineer
Office of Information Technology, Technology Infrastructure, Networking
Portland State University
503-725-3205



On Mon, Jan 27, 2020 at 11:37 AM Hurt,Trenton W. 
wrote:

> To get work on public ips try
>
>
>
>
>
> Go to chrome://flags/
>
> Search for “Connect to Cast devices on all IP addresses”
>
> Change from “default” to “enabled”
>
>
>
> *From:* The EDUCAUSE Wireless Issues Community Group Listserv <
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> *On Behalf Of *Carson, Dennis
> *Sent:* Monday, January 27, 2020 2:24 PM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] [External] [WIRELESS-LAN] Chromecasts and
> App on Phones
>
>
>
> We do use public ip space.
>
>
>
> *Dennis Carson*
>
> *California University of Pennsylvania*
>
> office: 724-938-4215
>
>
>
> *From:* The EDUCAUSE Wireless Issues Community Group Listserv <
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> *On Behalf Of *Norton, Thomas
> (Network Operations)
> *Sent:* Monday, January 27, 2020 2:13 PM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] [External] [WIRELESS-LAN] Chromecasts and
> App on Phones
>
>
>
> *[External]: *This email originated from outside of California University
> of Pennsylvania.
>
>
>
> Yep, Google developers in their infinite glory!
>
>
>
> Chromecast now complete an HTTP request as part of discovery, as well
> require you be on the same SSID for initial setup.
>
>
>
> Are you utilizing using public IPs?
>
>
>
> If so, I believe the chromecast has some weird mechanisim triggering a 403
> forbidden utilizing different IP spaces when utilizing public space.
>
>
>
> Private space should work with in different vlans/subnets.
>
> *T.J. Norton*
>
> *Wireless Network Architect*
> *Network Operations*
>
> *Office: (434) 592-6552 <(434)%20592-6552> *
>
>
>
> [image: http://www.liberty.edu/media/1616/40themail/wordmark-for-email.jpg]
>
> *Liberty University  |  Training Champions for Christ since 1971*
>
>
>
> On Jan 27, 2020, at 12:09 PM, Carson, Dennis  wrote:
>
> 
> --
>
> [ EXTERNAL EMAIL: Do not click any links or open attachments unless you
> know the sender and trust the content. ]
> --
>
> Hello,
>
>
>
> We use Cisco AP’s. We have one ssid for students, but it has multiple
> subnets. When the Chromecast and Phone end up on different subnets, they
> don’t seem to be able to connect.
>
> Do any colleges have any workarounds or solutions for this?
>
> Also, with the way these devices work, does anyone know if they need to be
> on the same subnet after the initial registration? Ie IF we use a hotspot
> to register them, will they work when they go back to their dorm?
>
>
> Thank you,
> Dennis
>
>
> --
>
>
> [image: Cal U Logo]
> *The content of this email is confidential and intended only for the
> recipient(s) specified. If you received this message by mistake, please
> reply so the sender can correct the error, and then delete this email
> immediately.

Re: [WIRELESS-LAN] Internet Connectivity Issues

2019-09-23 Thread Ethan Grinnell
What AP models do you have?

We're still on AireOS 8.5.144.33. The COS APs have been running pretty well
for us.

We've had intermittent issues on IOS APs though. The radios periodically
reset and can't seem to clear some packets. Once an AP starts having issues
the radio may even cycle every few minutes indefinitely. Do you monitor the
AP syslogs?

Here are the bug IDs for this:
*CSCvp86151 IOS APs radio reset with code 44, mostly seen on 2.4GHz radio*
*CSCvp66546 702w Radio reset due to tx stuck*

The first one doesn't have a real solution yet, we're running debug images
to capture more information. TAC says it might be related to high QBSS, but
I saw an AP report high QBSS with no other APs or other known Wi-Fi sources
above -80 dBm, so I'm not convinced.

The 702W bug has a good debug image in place though. TAC found that
stranded packets for clients in power save mode (mostly Murata or Samsung
S10 devices) would accumulate in memory and after 60 seconds the AP radio
resets to clear the packets. But the reset didn't clear them (or more
accumulated) so it just continues resetting the radio. The fixed image
discards packets that couldn't be transmitted after 20 seconds, without
resetting the radio. It also has a counter that shows the number of times
this was triggered and reset prevented

Another thing that comes to mind is the issue with MacOS devices sending
ARP replies for the gateway IP address. I haven't seen this one, but it
sounds similar enough to your issue.

https://www.cisco.com/c/en/us/support/docs/wireless/aironet-3800-series-access-points/214491-arp-responses-for-default-gateway-ip-add.html


On Mon, Sep 23, 2019, 6:33 PM Jason Cook  wrote:

> We have also experienced AVC crippling our network. Once the traffic
> volumes are higher than X. Performance goes south and can get to 0.
>
>
>
> Nothing else similar to your description, though that issue was on 8.2 and
> we are currently 8.5
>
>
>
>
>
>
>
> --
>
> Jason Cook
>
> Information Technology and Digital Services
>
> The University of Adelaide, AUSTRALIA 5005
>
> ---
>
> This email message is intended only for the addressee(s) and contains
> information which may be confidential and/or copyright.  If you are not the
> intended recipient please do not read, save, forward, disclose, or copy the
> contents of this email. If this email has been sent to you in error, please
> notify the sender by reply email and delete this email and any copies or
> links to this email completely and immediately from your system.  No
> representation is made that this email is free of viruses.  Virus scanning
> is recommended and is the responsibility of the recipient.
>
>
>
> *From:* The EDUCAUSE Wireless Issues Community Group Listserv <
> WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> *On Behalf Of *Lee H Badman
> *Sent:* Tuesday, 24 September 2019 9:25 AM
> *To:* WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
> *Subject:* Re: [WIRELESS-LAN] Internet Connectivity Issues
>
>
>
> Are you running AVC? If so, you might try disabling. It has caused us no
> end of trouble in the past, similar symptoms. One man’s opinion from past
> experience.
>
> Lee Badman (mobile)
>
>
> On Sep 23, 2019, at 7:49 PM, Gray, Sean  wrote:
>
> Hi Everyone,
>
>
>
> We are getting reports of internet connectivity issues from our wireless
> users. The problem is very temperamental with users bouncing from being
> able to browse & access App content flawlessly, to experiencing a complete
> failure to browse to websites and refresh App content. As an example I was
> able to successfully test Instagram via Safari on an iPhone, and
> simultaneously fail to see the same content on the Instagram App on the
> same phone.
>
>
>
> At this point we are struggling to narrow down the root cause. We have
> looked at everything from traffic volume to ISP instabilities. But as yet
> there is no consistent smoking gun. My reason for reaching out to the group
> is we are running slightly dated code on our HA pair of 5520s. We are
> running 8.8.111 and plan to upgrade to the latest release as soon as
> possible. But I’m wondering if anyone out there is running 8.8.111 that
> have seen or is seeing similar issues.
>
>
>
> Thanks
>
>
>
> Sean
>
> **
> Replies to EDUCAUSE Community Group emails are sent to the entire
> community list. If you want to reply only to the person who sent the
> message, copy and paste their email address and forward the email reply.
> Additional participation and subscription information can be found at
> https://www.educause.edu/community
>
> **
> Replies to EDUCAUSE Community Group emails are sent to the entire
> community list. If you want to reply only to the person who sent the
> message, copy and paste their email address and forward the email reply.
> Additional participation and subscription information can be found at
> https://www.educause.edu/community
>
> **
> Replies to EDUCAUSE Community Group emails are