Wireless Access

I have many such events in Aruba WLCs logs.

1) Is it critical and even on non-working day e.g. during the weekend I had several in logs...

2) I've increased default value of "Timeout " under related  "aaa authentication-server radius  <....>", but I also seen similar parameter under "aaa authentication dot1x <.....>"

Authentication Server Retry Interval                           5 sec
Authentication Server Retry Count                              3

Which will take preference "aaa authentication-server radius <....>" or "aaa authentication dot1x <.....>" or 

"aaa authentication dot1x <.....>" with its settings will trigger "aaa authentication-server radius <....>" with its own settings ?!

I spent a lot of time troubleshooting this and was even able to capture timeouts in a packet capture.  Aruba TAC just kept saying the client device was not responding to the Clearpass request.  We kept receiving more issues from users.  We are just finishing up resolving the issue today and created a one page word doc that I posted on youtube to hopefully help others out.  Our Event was 9002. 

https://youtu.be/Hl-mPWRHvWU

I have many such events in Aruba WLCs logs.

1) Is it critical and even on non-working day e.g. during the weekend I had several in logs...

2) I've increased default value of "Timeout " under related  "aaa authentication-server radius  <....>", but I also seen similar parameter under "aaa authentication dot1x <.....>"

Authentication Server Retry Interval                           5 sec
Authentication Server Retry Count                              3

Which will take preference "aaa authentication-server radius <....>" or "aaa authentication dot1x <.....>" or 

"aaa authentication dot1x <.....>" with its settings will trigger "aaa authentication-server radius <....>" with its own settings ?!

Hi @Angie, thank you for sharing your troubleshooting steps from ARUBA TAC. By chance, are you able to reshare this video? The link appears to be broken. I really appreciate any help you can provide. 

I spent a lot of time troubleshooting this and was even able to capture timeouts in a packet capture.  Aruba TAC just kept saying the client device was not responding to the Clearpass request.  We kept receiving more issues from users.  We are just finishing up resolving the issue today and created a one page word doc that I posted on youtube to hopefully help others out.  Our Event was 9002. 

https://youtu.be/Hl-mPWRHvWU

I have many such events in Aruba WLCs logs.

1) Is it critical and even on non-working day e.g. during the weekend I had several in logs...

2) I've increased default value of "Timeout " under related  "aaa authentication-server radius  <....>", but I also seen similar parameter under "aaa authentication dot1x <.....>"

Authentication Server Retry Interval                           5 sec
Authentication Server Retry Count                              3

Which will take preference "aaa authentication-server radius <....>" or "aaa authentication dot1x <.....>" or 

"aaa authentication dot1x <.....>" with its settings will trigger "aaa authentication-server radius <....>" with its own settings ?!

Hi @Angie, thank you for sharing your troubleshooting steps from ARUBA TAC. By chance, are you able to reshare this video? The link appears to be broken. I really appreciate any help you can provide. 

I spent a lot of time troubleshooting this and was even able to capture timeouts in a packet capture.  Aruba TAC just kept saying the client device was not responding to the Clearpass request.  We kept receiving more issues from users.  We are just finishing up resolving the issue today and created a one page word doc that I posted on youtube to hopefully help others out.  Our Event was 9002. 

https://youtu.be/Hl-mPWRHvWU

I have many such events in Aruba WLCs logs.

1) Is it critical and even on non-working day e.g. during the weekend I had several in logs...

2) I've increased default value of "Timeout " under related  "aaa authentication-server radius  <....>", but I also seen similar parameter under "aaa authentication dot1x <.....>"

Authentication Server Retry Interval                           5 sec
Authentication Server Retry Count                              3

Which will take preference "aaa authentication-server radius <....>" or "aaa authentication dot1x <.....>" or 

"aaa authentication dot1x <.....>" with its settings will trigger "aaa authentication-server radius <....>" with its own settings ?!

I have many such events in Aruba WLCs logs.

1) Is it critical and even on non-working day e.g. during the weekend I had several in logs...

2) I've increased default value of "Timeout " under related  "aaa authentication-server radius  <....>", but I also seen similar parameter under "aaa authentication dot1x <.....>"

Authentication Server Retry Interval                           5 sec
Authentication Server Retry Count                              3

Which will take preference "aaa authentication-server radius <....>" or "aaa authentication dot1x <.....>" or 

"aaa authentication dot1x <.....>" with its settings will trigger "aaa authentication-server radius <....>" with its own settings ?!

If you see timeouts, that can be a client configuration issue, or an MTU issue between your controller and ClearPass (or even AP and controller). If you have a non-responding backend authentication/authorization server (when using ClearPass, for other RADIUS servers the name may be different), that can also result in timeouts.

MTU can fragement the RADIUS/EAP packets and result them being dropped. If the client does not trust the RADIUS Server EAP certificate, or does have other issues with the supplicant configuration, this may happen as well.

What is the authentication you have configured?

What is the server certificate used?

Increasing the timeout value will in general not solve your issue. 

I have many such events in Aruba WLCs logs.

1) Is it critical and even on non-working day e.g. during the weekend I had several in logs...

2) I've increased default value of "Timeout " under related  "aaa authentication-server radius  <....>", but I also seen similar parameter under "aaa authentication dot1x <.....>"

Authentication Server Retry Interval                           5 sec
Authentication Server Retry Count                              3

Which will take preference "aaa authentication-server radius <....>" or "aaa authentication dot1x <.....>" or 

"aaa authentication dot1x <.....>" with its settings will trigger "aaa authentication-server radius <....>" with its own settings ?!

thanks for these points!

I've checked by pings

ping ip <RADIUS_IP> df-bit repeat 100 size 1472<o:p></o:p>

it shows all good (packets reaching related server) but during peak hours high losses due to congested links (during non-peak hours losses absent or just few)

!!!!!!.!!!!!!.!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!.!!!<o:p></o:p>

.!!!!!!.!!!.!!!!!!!!!!!!!!!!!!<o:p></o:p>

Will need to work to add bandwidth ...

If you see timeouts, that can be a client configuration issue, or an MTU issue between your controller and ClearPass (or even AP and controller). If you have a non-responding backend authentication/authorization server (when using ClearPass, for other RADIUS servers the name may be different), that can also result in timeouts.

MTU can fragement the RADIUS/EAP packets and result them being dropped. If the client does not trust the RADIUS Server EAP certificate, or does have other issues with the supplicant configuration, this may happen as well.

What is the authentication you have configured?

What is the server certificate used?

Increasing the timeout value will in general not solve your issue. 

I have many such events in Aruba WLCs logs.

1) Is it critical and even on non-working day e.g. during the weekend I had several in logs...

2) I've increased default value of "Timeout " under related  "aaa authentication-server radius  <....>", but I also seen similar parameter under "aaa authentication dot1x <.....>"

Authentication Server Retry Interval                           5 sec
Authentication Server Retry Count                              3

Which will take preference "aaa authentication-server radius <....>" or "aaa authentication dot1x <.....>" or 

"aaa authentication dot1x <.....>" with its settings will trigger "aaa authentication-server radius <....>" with its own settings ?!

You may consider to prioritize the RADIUS traffic, like you probably have for voice traffic to prevent those packets from being dropped if your link is congested.

thanks for these points!

I've checked by pings

ping ip <RADIUS_IP> df-bit repeat 100 size 1472<o:p></o:p>

it shows all good (packets reaching related server) but during peak hours high losses due to congested links (during non-peak hours losses absent or just few)

!!!!!!.!!!!!!.!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!.!!!<o:p></o:p>

.!!!!!!.!!!.!!!!!!!!!!!!!!!!!!<o:p></o:p>

Will need to work to add bandwidth ...

If you see timeouts, that can be a client configuration issue, or an MTU issue between your controller and ClearPass (or even AP and controller). If you have a non-responding backend authentication/authorization server (when using ClearPass, for other RADIUS servers the name may be different), that can also result in timeouts.

MTU can fragement the RADIUS/EAP packets and result them being dropped. If the client does not trust the RADIUS Server EAP certificate, or does have other issues with the supplicant configuration, this may happen as well.

What is the authentication you have configured?

What is the server certificate used?

Increasing the timeout value will in general not solve your issue. 

I have many such events in Aruba WLCs logs.

1) Is it critical and even on non-working day e.g. during the weekend I had several in logs...

2) I've increased default value of "Timeout " under related  "aaa authentication-server radius  <....>", but I also seen similar parameter under "aaa authentication dot1x <.....>"

Authentication Server Retry Interval                           5 sec
Authentication Server Retry Count                              3

Which will take preference "aaa authentication-server radius <....>" or "aaa authentication dot1x <.....>" or 

"aaa authentication dot1x <.....>" with its settings will trigger "aaa authentication-server radius <....>" with its own settings ?!