Slow connection to VLAN (UniFi + Smoothwall)

[Nick_Parker]

Hey all,

 

We have 2 wireless networks, DainfernCollege (192.168.x.x) & DFC Internet (10.0.x.x).

DainfernCollege is not VLAN'd and is connected to the rest of the network, Server 2008 DHCP server with Smoothwall (192.168.0.25) as the gateway & NTLM Authentication.

DFC Internet is VLAN'd (ID: 5) with Smoothwall (10.0.0.1) acting as the DHCP & Radius server, Core Authentication for Smoothwall.

The wireless points are UniFi APs (a mix of APs, Pros & outdoor units). The UniFi controller is cloud hosted.

 

 

 

I've received a lot of complaints recently about slow connections and delayed logons to the BYOD wireless network.

I tested it myself and noticed the same thing:

 

 

The connection to "DFC Internet" will sometimes drop or not be available, connecting to it is slow and can take 30 seconds.

Connecting to "DainfernCollege" seems much more stable and connecting to it takes seconds.

 

Given that both "DFC Internet" & "DainfernCollege" are being broadcast from the same APs, one SSID is stable and the other isn't, I have to assume the fault isn't with the APs.

This means that the delays are possibly being caused by the VLAN'ing, Smoothwall's DHCP, Smoothwall's RADIUS server or the UniFi AP's connection to the Radius Server?

 

If the VLAN'ing was incorrect then you wouldn't be able to connect at all so it kinda rules that out? Right?

Maybe Smoothwall isn't able to authenticate users fast enough? Or assign them IPs fast enough?

Or the UniFi APs aren't able to talk to Smoothwall for Radius authentication fast enough? Or Smoothwall isn't able to speak to AD fast enough for the Radius -> Active Directory link?

 

Has anybody else experienced anything similar or can give me any pointers? Any thoughts or suggestions would be greatly appreciated!

[Achandler]

Have you tested having the 2nd VLAN not use the Radius server, to prove that connecting to the wireless and then getting an IP address is quick?

 

To be honest if it is slow at this point, I would tend to think that there is an issue with DHCP, but it doesn't mean it isn't VLANed properly as you mgith have traffic from the wrong VLAN flooding this VLAN etc (more unikely but possible). It could also be the number of devices connected, is your DHCP scope definitely big enough?

 

We use to use Ident by IP for our guest wireless, it was easier for actual guests. If you dropped your wireless to be done via ident by IP then you could test it, then more on from there.

[Nick_Parker]

Thanks @Achandler, I'll try removing the Radius server requirement, I'll need to temporarily allow unauthenticated internet access on the VLAN tho, or I can change the authentication method to an SSL page.

 

The DHCP scope is 255.255.224.0 which gives us over 8000 addresses so the scope is more than big enough. Devices connected are averaging about 700.

 

I've never tried the Ident by IP, I'll read up on it a bit and see how it works.

[Nick_Parker]

Hey @Achandler, I'm still battling with this whole issue.

 

I've downgraded the firmware on all the UniFi APs from 3.2.1 to 2.4.6 after reading some UniFi Forum posts where users were saying that they were experiencing intermittent connectivity and that downgrading had helped.

Unfortunately it doesn't seem to have made any difference.

 

I've created another SSID on the same VLAN without the Radius Authentication and it still seems pretty unstable.

Lastly, I tried connecting to the other SSID that's not VLAN'd and has a Server 2008 based DHCP and even that has started dropping.

 

It's beginning to look like it might be the UniFi points that are just unable to handle all the traffic or the network itself.

You mentioned that there may be VLAN traffic flooding into the incorrect network, how about I go about checking to see if this is the case?

[Achandler]

What you say the connection is dropping, are they connecting then failing intermittantly then trying to reconnect or are they failing to connect to start with?

 

Have you tried plugging a laptop into a port of a switch with is just on your 2nd VLAN to check that it definitely work perfectly (gets DHCP etc). I would expect that it would because you say yoru original network is also failing now. I assume your oriignal SSID also has no RADIUS server, so it won't be that.

 

How many access points, do you have and what type are they? 700 devices could either be lots or not many depending on how many points they are across.

 

To check if there is any cross network traffic, depending on if you have setup routing, which you probably haven't. Then you can simply check by putting a laptop on one VLAN (with an IP from the other), then trying pinging back across because you shouldn't be ale too unless you have setup routing.

 

I would also be tempted to use wireshark briefly to look for errand packets.

[Nick_Parker]

Thanks @Achandler.

 

My phone, for example, will connect then a few minutes later it will go back to connecting (like it's waiting for an IP), then connect and then later it will go back into the connecting state.

I'll try connecting something directly to the VLAN and see how that goes! I'll also check the cross talk while connected.

Original SSID has no RADIUS server.

 

I'm busy testing now and everything seems to be running perfectly, but now there are only 300 or so users connected to the wifi so maybe it is the points after all?

I have 48 Unifi APs and PRO units. There is an average of 20 connections to each device although the point in my office where i'm doing most of the testing only has +- 6 or 7 devices connected to it and i'm still having issues.

 

Between classes when the kids are moving around and I imagine all their devices are moving from point to point is when I see a lot of Radius authentication errors on Smoothwall:

 

 

And once everyone is settled down then all the users that were getting radius authentication errors are suddenly able to authenticate without any issues.

[Achandler]

Your logs show a RADIUS login failures on a 192.168 address which is your default VLAN and has no radius server.

 

Maybe this is part of the problem.

[Nick_Parker]

The 192.168.x.x addresses are the UniFi AP addresses

[Achandler]

Sorry was a little bit busy yesterday.

 

So most errors are when people are jumping between points, which as you say makes perfect sense because they are authenicating from a different IP.

 

Your number of devices per AP shouldn't be an issue, I use to see about 900 across 35 points and there was no major issues with it, it wasn't a one to one iPad scheme or anything, mostly teachers iPads laptops and then students phones. I would be interested to see what happens when you have plugged directly into the VLAN with a cable because that woudl establish if DHCP and RADIUS is defintiely not the problem. As if your using the cable, the wireless points are beign bypassed.

[Nick_Parker]

Thanks @Achandler, I'm going to test with some cabled connections now over half term.

I very much appreciate all the assistance and suggestions you've been giving me.

[Nick_Parker]

Hey all, I ended up completely removing the VLAN while I test and the wireless network seems to work very well without any VLANs/Radius/Smoothwall DHCP.

Now I'm busy slowly putting it all back together piece by piece to try figure out where the trouble starts.

 

I just want to double check that I have the correct understanding for my VLAN'ing:

 

 

Obviously this is a very simplified version of what's going on

 

They are all either HP or Ubiquiti ToughSwitches, no trunking, Smoothwall is the RADIUS Server & DHCP Server for everything on VLAN 5.

VLAN 1 goes through to the Microsoft DHCP Server, Smoothwall uses NTLM authentication for all VLAN1 connections.

Edited October 31, 2014 by Nick_Parker
Wrong image

[Nick_Parker]

Apologies for the long delay in replying.

 

I took away the encrypted/VLAN/WPA2-Ent network and had everyone connected to the open network without any issues, it was fast and stable and didn't drop connections. This is great because it proves that it's not an issue with the points.

 

However, it does mean the issue has to be something else:

 

Smoothwall's DHCP server

Smoothwall's RADIUS server

The way the UniFi points are talking to Smoothwall's RADIUS server

I've buggered up the VLAN'ing for the encrypted network

 

I've contacted Smoothwall and requested one of their support technicians have a look at the setup but I haven't heard anything back from them yet.

I've been watching the SystemD log on smoothwall and I can see the same users logging in and logging out via 802.1X every few seconds which means something somewhere is wrong.

[Achandler]

Ive just looked at your VLAN image that looks perfectly correct.

 

I have got hold of some Unifi points and will be seeting up a BYOD network for students soon in a couple of test locations, so once i have given it a trial I'll let you know if I have similar issues.

 

Does the number of devices connected have any affect?

[Nick_Parker]

Thanks @Achandler

 

The whole system seems to work very well in the afternoons when there are less people here but I don't think it's the points that are the issue.

I have a point in my office which only ever has 8 - 10 connections to it so hardly overloaded but I notice the issues even in my office so it has to be coming from somewhere further down the line.

[fontburn78]

Hi Nick,

 

We have very similar setup to you and are having the same issues.

 

We have Trapeze managed Wifi using b/g radios (130 AP's on site) one ap at least in each classroom. 500 active users on average. Smoothwall is DHCP and Radius server.

 

What we are seeing is at the start of lessons 60% of Chromebook get connected to the Radius Wifi the rest fail. After a good 5-10 minutes the remaining 40% connect. Even if they get on there seems to be an issue with traffic being extremely slow until something balances out. Either Smoothwall or the APs. Once the balancing seems to finish all is fine.

 

The Wifi company are blaming the AP's for being slow/old with b/g radios not having enough bandwidth for clients when they start up and want us to purchase n/ac setup. We also had to set accounting and authentication settings to be enabled for the SSID ourselves as they did not set this up.

Smoothwall have been helping us. DHCP was having an issue which they have applied a hotfix. This fixes is in the next round of schedules updates for the appliance.

 

Doing a speed test in classrooms we get as low as 4Mps at the time but normally regardless of which wifi SSID or setup bandwidth is only about 15Mps. The best I've seen is 28Mps when noone is on site.

 

I'm totally lost myself as to what we can do get Radius wo work 100% of the time. Or even where the problem lies. My only thought it the radio speeds but I'm loathed to concede on this.

[Achandler]

As per my previous psot but later then expected! We are going to start going live with our students on the guest wifi using smoothwall for radius, so I will update you with any complaints, tweaks etc.

[Nick_Parker]

Hey @Achandler, how's it going with your roll out so far?

[Achandler]

Very slowly, having to reconvince members of SLT again. It was approved then now it's not.