Cambium Wireless - BYOD RADIUS issues

[AlexReedman]

Hi All,

 

we had a Cambium system installed over summer 2019 to replace an outdated HP MSM controller style system, we currently run around 60 APs (3 of which are external) and have a few SSIDs for school owned devices.

 

We started the roll out of BYOD for years 11,12 & 13 and wanted to simplify the connection process, so opted to use RADIUS auth via Smoothwall & NPS Server on one of our Domain Controllers.

 

The BYOD Network is also on a seperate VLAN to the standard corp network.

Since then, we have had increasingly problematic areas whereby the students are unable to connect to the BYOD SSID at all (whereas staff are still connected to the standard SSIDs) and the only fixes appear to be either forgetting the network on the client device, rebooting the problem AP or restarting the NPS service on the DC.

 

I cant yet work out whether all three items (Client forgetting network, Rebooting AP and restarting NPS Service) are related or are three seperate issues that appears to be presenting in the same way - as either one of the above fixes the issue for a period of time.

 

Has anyone else on here used a Cambium system that utilises RADIUS auth for a BYOD network?

 

There is a potential that we have too many APs in certain areas, as when this system was installed, the budget just wasnt there for a heatmap to be completed - so it was very much a guestimate as to where the APs were installed - I've been quoted over 6K for a full wireless survey, which at this point is just not feasable due to budgetary constraints.

 

I havent had much luck with Cambium support thus far, but still working towards troubleshooting the issues with them.

 

Any guidance or suggestions would be really helpful.

 

Cheers,

Alex

[Davit2005]

Have you got logging on the NPS?

 

Do users get IP addresses, are there any logs on DHCP servers etc.

 

Is there any issues with DHCP scopes running out?

 

I'd even go so far as to regularly use a personal device/devices yourself to see if you can experience the issue in a separate location in your office maybe. Hopefully will give you the chance and time to troubleshoot/pinpoint rather than the panic button and restart multiple services to fix :-)

 

Could be an issue with the wireless but just see if you can break it down a bit and rule out possible issues.

 

Get MAC addresses of effected devices etc.

Edited December 11, 2020 by Davit2005

[Molsey]

Hi Davit2005,

I'm the IT Tech for the school that AlexReedman works for.

Just to provide you with more information

It has been logging to the NPS server.

This is where it gets mixed, Users either experience one of two things, They try to connect and before it even prompts them to place in their credentials, it states that they can't connect. or they can connect, they get an IP they'll get internet connection for about 30 seconds to a minute then it drops off and it states they have no internet, and then they can't use the internet.

I've been using my personal phone - Oneplus 5T, ive had no problems with it at all, but when I've used by domain joined school laptop and i've mostly experienced the latter issue.

Theres no issues with the DHCP scope, its on a 10.100.0.0/16 scope which served out by the Smoothwall. and we definitely aren't using all of that scope

I've been doing even more troubleshooting today, and i think i've narrowed it down to the Smoothwall being the issue. When i use the functionality test tool on the Smoothwall, it advised that our radius packets are missing their calling-station-id and nas-ip-address attributes. but ive done a Wireshark trace today, and can confirm that the radius packets do have those attributes. (screenshots below).

 

[ATTACH=CONFIG]60165[/ATTACH]

[ATTACH=CONFIG]60164[/ATTACH]

[simpsonj]

Apologies for the necro thread, but I'm having a similar issue with my Cisco Meraki Setup. Students can authenticate fine, but it's very hit and miss as to whether their network traffic is kept assigned to their username, or reverts to the IP address, which from a safeguarding point of view, is less than ideal.

 

Similar to @Molsey Smoothwall diagnostics say that calling-station-id and nas-ip-address attributes aren't being sent, but I'm 99% certain they are!

 

Is the better bet to use a Windows server for NPS and send the accounting to Smoothwall?

 

- - - Updated - - -

 

Apologies for the necro thread, but I'm having a similar issue with my Cisco Meraki Setup. Students can authenticate fine, but it's very hit and miss as to whether their network traffic is kept assigned to their username, or reverts to the IP address, which from a safeguarding point of view, is less than ideal.

 

Similar to @Molsey Smoothwall diagnostics say that calling-station-id and nas-ip-address attributes aren't being sent, but I'm 99% certain they are!

 

Is the better bet to use a Windows server for NPS and send the accounting to Smoothwall?

[scolman5]

I am getting the same problem. Using Cisco Meraki, Windows NPS and Smoothwall for radius accounting.

Users can authenticate fine and gets an IP address however I get no internet. They have to turn off Wi-Fi and turn it back on and you can browse straight away. Really annoying.

I have confirmed from Meraki they are sending the relevant attributes, but Smoothwall diagnostics still showing otherwise.

 

Anyone tried sending accounting to Smoothwall from NPS instead? Or have even come across this issue?

[simpsonj]

Do you have a Captive Portal in place? If that fails to load, that could be blocking access, turning the WiFi off and on might be kicking it into action?

 

I've turned mine off to see if that helps with RADIUS accounting, but now have to wait to see if it has made any impact!

[scolman5]

No Captive Portal here - just radius authentication via a Windows Server running NPS. Authentication and DHCP assignment is fine, just internet browsing on the initial connection and\or when you haven't connected in however long.