Controllerless Networks

Hi 

One of our customers notice that most MacOS Devices (IPad, IPhone and MAC) are not able to connect anymore  to his Guest Wifi (a few weeks ago it worked fine).

The Guest Wifi is configured like this:

Security Level - Visitors

Type - Cloud Guest

Encryption - Disabled

Key Management - Enhanced Open

Use IP for Calling Station ID - Disabled

Enforce DHCP - Disabled

WPA3 Transition - Disabled

Tests of the customer shows that he can connect with other devices like Windows or Android.

The APs were rebootet and updated to the latests Firmware (10.4.1.10 / 10.7.2.2) but still the same.

We do not see any log in Central about the MAC-Address of the clients / and on the MacOS Client he receive a message about a "Blockingmode". But connection is even not possible when this mode is disabled on the phone.

Does someone have an idea or a hint about this issue.

Thanks for your help.

Kind regards

Dominik

-------------------------------------------

i have not come across this issue, perhaps it'll be better to contact TAC.

------------------------------
If my post was useful accept solution and/or give kudos.
Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
------------------------------

When contacting HPE Technical support, the key information is whether the devices were able to associate to the AP - or not.

a) what changed weeks ago ? iOS updates ?

b) could it be the devices are also reporting "lock down mode" ?

c) Included in the AP tech-support :

show ap association

show ap debug mgmt-frames

show ap debug auth-trace

show log sys XXX | inc <client MAC>

If no association happens, likely an 802.11 packet capture is going to be needed to understand what is going wrong.

(Taken from the target AP, a nearby AP, or another device near the client device and the target AP)

If the association is happening, but the connection failing at a higher layer, the AP tech-support delivers more, we're then interested in the role assigned, and perhaps

the Apple Captive Portal Detect (CNA)

show clients

show ap debug client-table | inc <client mac>

Identifying whether or not association happens will help fill out the picture.

------------------------------
Shawn Adams
------------------------------

After few more tests we were able to solve the issues by enabling the WPA3 Transition mode on the SSID.

(this option was disabled by the customer a few weeks agoo because of some other problems with iOS devices).

After enabling this everything is working as expected.

-------------------------------------------