Wireless Access

 View Only

  • 1.  Packet-Capture on AP Uplink with "Decrypt-Tunnel"

    Posted Dec 08, 2020 02:19 PM
    Edited by cbjohns Dec 08, 2020 02:27 PM

    Attempting to do a packet-capture via span-port on an Aruba AP's uplink, and I suspect that Wireshark doesn't have the right dissector available for "Decrypt-Tunnel" traffic. Is there one available or other means or properly viewing the captured traffic?

    We're troubleshooting a recently discovered issue on our APs (tunneled mode) operating over an ASA VPN IPsec tunnel - 8.5.0.9 and 8.3.0.7 - Download Speeds are poor (500 Kbps to 3Mbps), but upload speeds appear to be normal 60 Mbps). Fragmentation was the first thing we checked as we hit the problem 6 years ago during initial deployment. We have our APs set at MTU 1200, which is about 200 below what is necessary while troubleshooting.

    What we did learn was Open SSID (Guest Traffic) is unaffected by the degradation of throughput - which is naturally unencrypted over the tunnel which gave me the idea to test "Decrypt Tunnel" on our 802.1X network which did make the the problem go away. So suspect the VPN/firewall is possibly classifying the traffic in a degrading way - hence why wanted to get a view of the traffic via Decrypt-Tunnel mode.




    ------------------------------
    Chris
    ------------------------------


  • 2.  RE: Packet-Capture on AP Uplink with "Decrypt-Tunnel"

    Posted Dec 09, 2020 11:28 PM
    decrypt tun traffic should be GRE from the perspective of the span port, Wireshark should show it without any problems - maybe a capture filter issue or a problem with the capturing device (maybe cannot capture vlan tagged traffic for example ?)


  • 3.  RE: Packet-Capture on AP Uplink with "Decrypt-Tunnel"

    Posted Dec 10, 2020 05:43 PM

    Thanks jgoff,

    Oddly it does show the GRE Headers correctly, but the payload inside the tunnel appears to be "misinterpreted" as strictly Association and Reassociation requests with non-nonsensical source, destination, transmitter addresses. Can even see some of the original "data" inside of it like when my cape sensor is reaching out the gateway or random "youtube.com" URLs showing up in an "SSID" - strange!



    ------------------------------
    Christopher Johnson
    ------------------------------

    Original Message


  • 4.  RE: Packet-Capture on AP Uplink with "Decrypt-Tunnel"

    Posted Dec 11, 2020 12:41 AM
    So basically wireshark is decoding what is beyond the GRE header as 802.11 frames.  You'll need a dissector that interprets it as ethernet instead.

    ------------------------------
    Michael Clarke (Aruba)
    ------------------------------

    Original Message


  • 5.  RE: Packet-Capture on AP Uplink with "Decrypt-Tunnel"

    Posted Dec 10, 2020 02:13 AM
    I saw a similar issue when there was a Checkpoint firewall in between the AP and controller.  Was some sort of fancy inspection feature that was causing problems.  Once that was turned off, it was all good.

    ------------------------------
    Michael Clarke (Aruba)
    ------------------------------



  • 6.  RE: Packet-Capture on AP Uplink with "Decrypt-Tunnel"

    Posted Dec 10, 2020 05:48 PM

    Thanks Michael,

    You gave me a couple ideas to investigate. Saw a lot of good info on Cisco Firepower related to fastpaths to bypass inspection for encrypted GRE tunnels as best practice, but don't have Cisco Firepower enabled. Still a bit of progress though. Have a TAC case open with Cisco.

    I was curious if you could help me understand another matter. Typically always use the "Do Not Fragment" flag with pinging to determine the maximum MTU Size. When pinging in this matter over our tunneled SSIDs (even with MTU set at 1200) - I'm still able to send a ping up to 1472. I imagine this is just due to my lack of full understanding of IP Fragmentation vs 802.11 Fragmentation (AP fragmenting the frames before sending it through the tunnel)?



    ------------------------------
    Christopher Johnson
    ------------------------------

    Original Message


Related Content