Good Afternoon Cfinch,
These Hot Spots may very well be contributing to this type of behavior. Blocking them with the Intrusion Detection settings will not lessen their effect on your wireless, but rather it will make it so no one can join those Hot Spots. So if they are legitimate, I would look into whether or not you should actually be blocking them due to the Users attempting to use those Hot Spots for their intended purposes. One thing you will need to look out for as well are SSID Spoofing Attacks. These will be attackers broadcasting the same SSID name as yours in the hopes of your Users connecting to their WLAN. These types of attacks can come across as the symptoms you described above where the Users are seemingly connected to the correct SSID, but they cannot access the Internet or network drives. This is a time where you will want to block the BSSID of whoever is broadcasting the faux SSID so that no one will be able to connect to it, thus stopping the attacker's SSID from being accessible.
One thing you can do on your side is run an Auto-Channel (Using the Array's Web Management Interface, or WMI, go to Configuration>IAPs>Advanced RF Settings>RF Spectrum Management>Auto Channel Configuration Mode, check "Full Scan", and hit "Auto Configure") on your Array(s) which will bring down all of your IAPs, scan the air, and choose the cleanest channels for broadcasting your SSID. Apart from coordinating with the Administrator of said Hot Spots for channel selection, there is not much else you can do in regards to wireless networks surrounding your network(s).
With respect to unassociated stations affecting your Array's performance, this is negligible in the grand scheme of things. In high density environments however, you can see what we call "Probe Request Floods" if all of these devices are looking for somewhere to connect. There are some defenses against this, but I would open up a ticket with our Customer Support team for further triage before going down that path.
The length of your Users' session may or may not be of consequence here, depending on how those sessions have ended as well.
All of the above will of course be conjecture due to the fact of not knowing exactly what we're working with here. We provide the ability for you to help us diagnose issues like these in the form of a Diagnostic Log. One way to generate this log is by using the Array's WMI and going to Tools>System Tools>Diagnostics and hitting the "Update" or "Create" button to generate a new log. This will activate the link to the left of that button called "diagnostic.log". You can send that to
[email protected] where our 24/7 Customer Support team will begin helping you to diagnose your issues and guide you along a quick path to resolution.
Regards,
Kyle
