Xirrus Connection Issues

[cfinch]

Good Morning All,

 

So I'm having an issue with my network. I have full bars for many students, but they can't get anywhere online. They constantly get the "This webpage is not available" or "You are not connected to a network". I think that there is an issue with the AT&T and TWC hot spots that are flooding our devices on all 2.4 and many 5.0 channels. I try to block them in intrusion detection, but it seems to make the issue worse. When I look at the device I see that I have users on, but they are only on for a few minutes. There are always 1 or 2 users that are on for 40+ minutes, but the majority seem to on for 1-4 minutes.

 

Also

 

I notice that when I go to see who is online, I'll have a few associated and about 400+ unassociated. Could this be cause my device to be maxed out, even though they aren't officially associated. I figure that there has to be some association because there is a transfer of packets, even though they are minute, which is telling the IAP's that they have reached their max amount. Does this sound possible?

 

Please let me know if you have any advice or info because I'm beating my head against the wall.

 

Thanks

Cfinch

[brandonmillerx]

I am having the same sort of problems. What model of Xirrus AP are you using? We are using the 520. One per class room. Connections drop when the students roam between class room changes.

[cfinch]

It's an XR4820. We had that issue with the iPads, so we had to flatten out the wireless VLAN's to a single VLAN.

[XirrusTech]

Good Afternoon Cfinch,

 

These Hot Spots may very well be contributing to this type of behavior. Blocking them with the Intrusion Detection settings will not lessen their effect on your wireless, but rather it will make it so no one can join those Hot Spots. So if they are legitimate, I would look into whether or not you should actually be blocking them due to the Users attempting to use those Hot Spots for their intended purposes. One thing you will need to look out for as well are SSID Spoofing Attacks. These will be attackers broadcasting the same SSID name as yours in the hopes of your Users connecting to their WLAN. These types of attacks can come across as the symptoms you described above where the Users are seemingly connected to the correct SSID, but they cannot access the Internet or network drives. This is a time where you will want to block the BSSID of whoever is broadcasting the faux SSID so that no one will be able to connect to it, thus stopping the attacker's SSID from being accessible.

 

One thing you can do on your side is run an Auto-Channel (Using the Array's Web Management Interface, or WMI, go to Configuration>IAPs>Advanced RF Settings>RF Spectrum Management>Auto Channel Configuration Mode, check "Full Scan", and hit "Auto Configure") on your Array(s) which will bring down all of your IAPs, scan the air, and choose the cleanest channels for broadcasting your SSID. Apart from coordinating with the Administrator of said Hot Spots for channel selection, there is not much else you can do in regards to wireless networks surrounding your network(s).

 

With respect to unassociated stations affecting your Array's performance, this is negligible in the grand scheme of things. In high density environments however, you can see what we call "Probe Request Floods" if all of these devices are looking for somewhere to connect. There are some defenses against this, but I would open up a ticket with our Customer Support team for further triage before going down that path.

 

The length of your Users' session may or may not be of consequence here, depending on how those sessions have ended as well.

 

All of the above will of course be conjecture due to the fact of not knowing exactly what we're working with here. We provide the ability for you to help us diagnose issues like these in the form of a Diagnostic Log. One way to generate this log is by using the Array's WMI and going to Tools>System Tools>Diagnostics and hitting the "Update" or "Create" button to generate a new log. This will activate the link to the left of that button called "diagnostic.log". You can send that to [email protected] where our 24/7 Customer Support team will begin helping you to diagnose your issues and guide you along a quick path to resolution.

 

Regards,

Kyle

Edited December 13, 2014 by XirrusTech

[cfinch]

Good Afternoon Cfinch,

 

These Hot Spots may very well be contributing to this type of behavior. Blocking them with the Intrusion Detection settings will not lessen their effect on your wireless, but rather it will make it so no one can join those Hot Spots. So if they are legitimate, I would look into whether or not you should actually be blocking them due to the Users attempting to use those Hot Spots for their intended purposes. One thing you will need to look out for as well are SSID Spoofing Attacks. These will be attackers broadcasting the same SSID name as yours in the hopes of your Users connecting to their WLAN. These types of attacks can come across as the symptoms you described above where the Users are seemingly connected to the correct SSID, but they cannot access the Internet or network drives. This is a time where you will want to block the BSSID of whoever is broadcasting the faux SSID so that no one will be able to connect to it, thus stopping the attacker's SSID from being accessible.

 

One thing you can do on your side is run an Auto-Channel (Using the Array's Web Management Interface, or WMI, go to Configuration>IAPs>Advanced RF Settings>RF Spectrum Management>Auto Channel Configuration Mode, check "Full Scan", and hit "Auto Configure") on your Array(s) which will bring down all of your IAPs, scan the air, and choose the cleanest channels for broadcasting your SSID. Apart from coordinating with the Administrator of said Hot Spots for channel selection, there is not much else you can do in regards to wireless networks surrounding your network(s).

 

With respect to unassociated stations affecting your Array's performance, this is negligible in the grand scheme of things. In high density environments however, you can see what we call "Probe Request Floods" if all of these devices are looking for somewhere to connect. There are some defenses against this, but I would open up a ticket with our Customer Support team for further triage before going down that path.

 

The length of your Users' session may or may not be of consequence here, depending on how those sessions have ended as well.

 

All of the above will of course be conjecture due to the fact of not knowing exactly what we're working with here. We provide the ability for you to help us diagnose issues like these in the form of a Diagnostic Log. One way to generate this log is by using the Array's WMI and going to Tools>System Tools>Diagnostics and hitting the "Update" or "Create" button to generate a new log. This will activate the link to the left of that button called "diagnostic.log". You can send that to [email protected] where our 24/7 Customer Support team will begin helping you to diagnose your issues and guide you along a quick path to resolution.

 

Regards,

Kyle

 

Hi Kyle,

 

I really appreciate your response. I sort of had this issue dropped in my lap with no prior wireless networking experience.

 

I'll try the auto channel configuration first. The only thing that I worry about is that the TWC, Cable WiFi, and AT&T WIFI that are on all of the telephone poles, about 30 feet away from our window, are putting out channels 1, 6, & 11. If the auto channel cuts out those 3 then I lose all 2.4 channels that don't overlap.

 

If that doesn't work, I'll start working with your support team.

 

Thanks for letting me know about the Intrusion Detection.

 

Our network area that is having trouble has about 14 units, with 4-8 radio's per unit, for 1500 devices in 1 building that is 2 stories. Would you consider that high density?

 

Once again thanks for all the info you've provided.

 

Cfinch