Hi Stephen, I just replied to Tristan with the following – “So the problem with the specific student I mentioned seemed to resolve itself. Our latest issue, that seems to again only impact the 702w involves a couple of MacBook Air users, running either Sierra or High Sierra. A debug shows that on occasion when trying to connect to a.1x network they make it as far as the DHCP required state and then never request an IP. They hit the timeout, the WLC deletes the client and the dance begins again.”
So unless the students aren’t complaining and choosing to use our Guest network in the limited areas where 702ws are installed, our issue is now isolated to MacBook Airs connecting to .1x networks via a 702w AP. On the plus side we don’t have “Allow AAA Override enabled” on our Student WLAN, so at least we know that isn’t part of the problem. As this seems to be a severely isolated issue our next move will be to swap out the 702w in the area reporting problems. Thanks Sean From: The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Stephen Belcher Sent: April-09-18 6:31 AM To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU Subject: Re: [WIRELESS-LAN] More client weirdness We hit the same bug on 8.3.133.0 code. After running a debug code on the 702w (and with the help of a very nice student), Cisco determined it was change of auth that was causing the issue. We disabled “Allow AAA Override” on the WLAN which seems to have mitigated the issue. Fortunately, we aren’t using the AAA Override at this time. Cisco hasn’t sent us a bug number and it’s not showing in the open Caveats yet. If I get more info from Cisco I will send it to the group. Let me know if you have any questions. Steve / Stephen Belcher Assistant Director of Network Operations WVU Information Technology Services (681) 214-3389 mobile From: The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Tristan Gulyas Sent: Sunday, April 8, 2018 10:03 PM To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> Subject: Re: [WIRELESS-LAN] More client weirdness Hi all, We've hit this issue as well. Ever since moving from 8.3.112.7 to 8.3.135.2. What we see: * Devices with the Killer NIC 1535 authenticate but can't pass traffic. * Apple devices will connect, pass traffic for a while, then go dead. We believe we may have seen this on a 1532 series AP as well. Debugs don't seem to give us much. 3702i, 3802i appear to be unaffected. Cheers, Tristan -- TRISTAN GULYAS Senior Network Engineer Technology Services, eSolutions Monash University 738 Blackburn Road Clayton 3168 Australia T: +61 3 9902 9092 M: +61 (0)403 224 484 E: tristan.gul...@monash.edu<mailto:tristan.gul...@monash.edu> monash.edu<http://monash.edu/> On 1 Feb 2018, at 8:40 am, Gray, Sean <sean.gr...@uleth.ca<mailto:sean.gr...@uleth.ca>> wrote: Yep, I noticed this too. Unfortunately we jumped onto 8.3.133.0 prior to the discovering of the catastrophic bug. Hopefully they publically release a fixed version soon. From: The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Kitri Waterman Sent: January-31-18 1:09 PM To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> Subject: Re: [WIRELESS-LAN] More client weirdness This sounds like a specific client issue but TAC does have warning out about any 8.3.13x code: https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html#anc9 You can request the 8.3.133.10 escalation code and also sign up for the 8.3MR4 Interim code. Best of luck, Kitri Waterman Network Architect/Engineer Enterprise Infrastructure Services (Networks) Western Washington University 360.650.4027 kitri.water...@wwu.edu<mailto:kitri.water...@wwu.edu> From: The EDUCAUSE Wireless Issues Constituent Group Listserv <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>> on behalf of "Gray, Sean" <sean.gr...@uleth.ca<mailto:sean.gr...@uleth.ca>> Reply-To: The EDUCAUSE Wireless Issues Constituent Group Listserv <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>> Date: Wednesday, January 31, 2018 at 10:34 AM To: "WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>" <WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU>> Subject: Re: [WIRELESS-LAN] More client weirdness Hi Craig, Sorry I should have mentioned that, our WLC is a 5520 running 8.3.133.0 code Sean From: The EDUCAUSE Wireless Issues Constituent Group Listserv [mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of Craig Eyre Sent: January-31-18 11:30 AM To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU<mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU> Subject: Re: [WIRELESS-LAN] More client weirdness Sean, What version of controller software are you running? Craig Eyre On Wed, Jan 31, 2018 at 11:17 AM, Gray, Sean <sean.gr...@uleth.ca<mailto:sean.gr...@uleth.ca>> wrote: Hi Everyone, I just wanted to throw this weirdness out to the group to see if anyone has experienced the same issue and has found a solution or work around. We have a student on campus who intermittently cannot connect to our 802.1x Student WLAN when trying to connect to a Cisco 702w access point installed nearby. They can connect to our open Guest WLAN. I should say that they are fail to connect to Student more times than they succeed when in their Student Residence. On campus they are able to connect to Student. I recently brought them down to my office to have them try and connect to a 702w that I had set up specially for the purpose of this test. Client Details: • Acer Aspire F5-571T Laptop • NIC: Qualcomm Atheros QCA9377 • Driver Version 12.0.0.309 • O/S: Windows 10 Home Client has Symantec Anti-virus installed Windows updates and driver versions were all validated. During testing I noticed that the client completes the AUTH phase and enters RUN state. At this point it frequently seems to stall and doesn’t make it into the DHCP Socket Task portion of the client/WLC/DHCP exchange. The only thing that the testing proved to me is that the client doesn’t like Cisco 702w APs, as I saw the same results in my office as I saw from them in Student Residence. Of note is that the problem seems to become particular pronounce when they roam from Guest to Student or vice versa. Disabling the Symantec firewall seemed to improve, but not fully resolve the issue. I should also point out that due to the unique way that our Residence townhomes were constructed wall mount APs are our only option. So this one has me beat! Thanks Sean ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found athttp://www.educause.edu/discuss. -- Craig Eyre Network Analyst IT Services Department Mount Royal University 4825 Mount Royal Gate SW Calgary AB T2P 3T5 P. 403.440.5199 E. ce...@mtroyal.ca<mailto:ce...@mtroyal.ca> "The difference between a successful person and others is not a lack of strength, not a lack of knowledge, but rather in a lack of will." Vincent T. Lombardi" MRU IT Services will NEVER ask you for your password or to update or verify your email account through an email. DO NOT click any links in an email asking you to update or verify your email account. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found athttp://www.educause.edu/discuss. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/discuss. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found athttp://www.educause.edu/discuss. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/discuss. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/discuss. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/discuss. ********** Participation and subscription information for this EDUCAUSE Constituent Group discussion list can be found at http://www.educause.edu/discuss.