Wireless

Hello,

I am troubleshooting a problem where users are experiencing random disconnects while connected to my 802.1x campus network. I am running physical controllers using AOS 8.12.0.5. I also use Clearpass as my NAC and Airwave for log collection. I've found some interesting data points, but don't know where to go with it. I've opened a support case, but thought I would also see if I can get an answer quicker here. I am also running a user debug on my own device, but it's unpredictable when the disconnect will occur so I don't know if that will capture anything useful.

Here's what I found:

At the time that the disconnect is reported, I see a RADIUS Accounting Issue with the Event "Accounting server request timed out for clearpass". I looked up that error and found a thread that describes the behavior I'm seeing almost exactly, but doesn't have a solution. "This client intermittently faces 4–5 request timeouts (RTOs) while pinging global FQDNs like google.com, followed by disconnection from Wi-Fi and then reconnection to the SSID."

I also see a log for an IDS event of a StationDisconnectAttack at the exact timestamp. It's unclear to me if this is an actual attack, or if it's a response to the client unexpectedly disconnecting.

wlsxNDisconnectStationAttack wlsxTrapAPMacAddress.0: AA:BB:CC:C3:A6:D2,
wlsxTrapSnr.0: 31, wlsxTrapAPBand.0: 5GHz, wlsxTrapAPLocation.0:
correlated-AP.B.32, wlsxTrapAPChannel.0: 149, wlsxTrapTargetAPBSSID.0:
98:8F:00:0D:67:F1, wlsxTrapAPRadioNumber.0: 1, wlsxTrapTargetAPSSID.0:
eduroam, wlsxTrapTime: 12/9/2025 10:44:36 UTC-5, wlsxTrapSourceMac.0:
AA:BB:CC:93:D2:5D

Appreciate any help, and happy to provide any other details that could be useful!

-------------------------------------------

The accounting server request timeout suggests that the controller is disconnected from the network, or the AP-controller connection is disconnected.

If you have multiple devices, do they experience the issue all at the same time? Or when connected to the same AP, do all clients experience the same?

Do you have your WIDS configured for reporting only? Or does it have protection enabled?

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

Original Message:
Sent: Dec 09, 2025 02:32 PM
From: jatsb6
Subject: Random Wireless Disconnects

Hello,

I am troubleshooting a problem where users are experiencing random disconnects while connected to my 802.1x campus network. I am running physical controllers using AOS 8.12.0.5. I also use Clearpass as my NAC and Airwave for log collection. I've found some interesting data points, but don't know where to go with it. I've opened a support case, but thought I would also see if I can get an answer quicker here. I am also running a user debug on my own device, but it's unpredictable when the disconnect will occur so I don't know if that will capture anything useful.

Here's what I found:

At the time that the disconnect is reported, I see a RADIUS Accounting Issue with the Event "Accounting server request timed out for clearpass". I looked up that error and found a thread that describes the behavior I'm seeing almost exactly, but doesn't have a solution. "This client intermittently faces 4–5 request timeouts (RTOs) while pinging global FQDNs like google.com, followed by disconnection from Wi-Fi and then reconnection to the SSID."

I also see a log for an IDS event of a StationDisconnectAttack at the exact timestamp. It's unclear to me if this is an actual attack, or if it's a response to the client unexpectedly disconnecting.

wlsxNDisconnectStationAttack wlsxTrapAPMacAddress.0: AA:BB:CC:C3:A6:D2,
wlsxTrapSnr.0: 31, wlsxTrapAPBand.0: 5GHz, wlsxTrapAPLocation.0:
correlated-AP.B.32, wlsxTrapAPChannel.0: 149, wlsxTrapTargetAPBSSID.0:
98:8F:00:0D:67:F1, wlsxTrapAPRadioNumber.0: 1, wlsxTrapTargetAPSSID.0:
eduroam, wlsxTrapTime: 12/9/2025 10:44:36 UTC-5, wlsxTrapSourceMac.0:
AA:BB:CC:93:D2:5D

Appreciate any help, and happy to provide any other details that could be useful!

-------------------------------------------