Wireless Access

I am using a MSM765zl Mobility Controller with WPA/WPA2 in my VSC. I can sign on with domain joined wireless stations just fine. When I configure an iPad, I am prompted for a username and password, prompted to accept an internal certificate, and everything connects fine. My issue seems to be when that user travels to another location; which of course means in another subnet, and has to go through the reauthentication process on the iPad. I have "Wireless Mobility" checked on the VSC and using "Subnet-based mobility" instead of Mobility Traffic Manager. I also have "WPA2 opportunistic key caching" checked as well. Is this possibly due to the fact that the certificate is from my internal CA and not a trusted public CA? I need to try and get this resolved... Any thoughts?

I have "WPA2 opportunistic key caching" disabled on the VSC's that holds iPads.

I found that even though it is not exactly new technology, it is not supported on iPads.

I don't know if it will help you with your problem, but turning it off is definitely the way to go with iPads on your wireless installation. Ipads on our network had problems roaming between AP even on the same subnet with "WPA2 opportunistic key caching" enabled. 

Hope you solve your problem.

Kind regards Erik.

Thanks Erik, I'll give it a shot to see if that will help. I'll post back in a few days to let you and everyone else whom this might apply to if this worked for me.

I am definitely interested in the results -- I am finishing up a network upgrade to support an iPad rollout next year (1,500 in a school), I have 60 MSM430 & 566's, and two 5406's each with a MSM765zl. I was planning to use the opportunistic key caching, since students and teachers will be walking all over with the iPads, and I thought not having to re-authenticate with each AP they pass by would reduce the load on the system. 

I would also like clarification on "I found that ... it is not supported on iPads." Do you mean that HP does not support OKC with iPads, or iPads somehow can't make use of that type of system (which seems hard to believe, I have found them to be very good at finding and connecting to known networks with no user interaction.)

Thanks for any further info either of you can provide. 

Ok, just an update on this. After I had a weird issue creep up all of a sudden, I had to call into tech support where I got to talk to a very knowledgable engineer. He looked at my config and pointed out a few misteps I had that he said ultimately will need to be addressed. Don't know if any of these misteps had anything to do with the current problem I was having, but it was good information non the less. He wanted me to turn back on oportunistic key caching for one thing even after I explained about the iPads; however, he felt that was related to other config issues. One of the things he pointed out was, I was doing super netting for my active route back to my LAN subnets which he said the controller technically does not support and that could potentially cause issues. The other config issue which is major is that since v 5.4 of the software, the mobility functionality needs distinct VLAN tag IDs. In my situation, I am separated by L3 routes, so L2 VLAN IDs don't have any affect, by them being the same, on those other subnets...well evidently it does when it comes to this controller and software code. If the subnets you report to the controller are all not on their own distinct VLAN ID, this will cause issues with mobility. So I guess I know what I'll be doing over the summer. He could not say for certain if correcting these issues would solve my iPad issue roaming across subnets, but he did know for sure that these two misteps would need to be corrected to be supported by the current software code of the controller.

I got the info from an Aruba document claiming that iPads (not HP) does not support Opportunistic key caching

Document can be found here.

http://www.arubanetworks.com/pdf/technology/whitepapers/wp_iPad-in-Enterprise.pdf

I did some slight  testing with two AP's and a bunch of iPads.

Initial "logon" to the first AP was smooth and problem free.

Moving closer to the other AP (on the same subnet) and the iPads stopped having internet access.

They all seemed to be connected to the SSID but internet access did not work.

I had to disable Wireless LAN and then enable it aging and then they would work fine again.

This was done on FW 5.5.2.14 I have not tested it again.

I do not have the facilities to test again, as this is almost a "mission critical" network and I do not want to mess around with something that is kinda working.

Hope this helps

Kind regards

Erik Behrendt

I am seeing problems with iPads too...  but mainly because, we have carts and carts full of iPads (30 per cart).  And even when they aren't being used and sitting in the cart in sleep mode, the iPads are STILL maintaining a connection to the nearest AP.   So if we have (3) carts of iPads in a given area that aren't even being used, we can see at least 90 active wireless connections at that time.  When viewing the connections on the MSM web interface and looking at the client itself, by it's MAC address, we will see "Power save state: On" on those connections.   Seems like we end up overcommitting our radios because of sleeping iPads.

So take those 90 iPads connections which aren't even being used, and then try and use a FEW laptops for internet browsing, email, or applications hosted on a server, and the result is horrendous.  Not sure how to combat this...  Getting users to turn OFF the iPads has been impossible.

Very frustrating.

JR

If anyone from HP is listening, I would recommend they produce a whitepaper or best practices on this matter. Gone are the days of wireless tech being used for laptops...it's all about the slate devices and handhelds based on Apple's IOS or Android.

If a client (such as an iPad) doesn't support a feature (such as"WPA2 opportunistic key caching"), is it harmful for that feature to be enabled in the VSC?  So OKC wouldn't apply to that client, but turn it off for the whole VSC?

thanks,

noemi

WPA2 opportunistic key caching is used in Layer 3 roaming, in L2 roaming there shouldn't be any issue as far as I know with WPA/WPA2 and all the APs are in the same VLAN no L3 roaming between SSID that has 2 subnets.

>in L2 roaming there shouldn't be any issue as far as I know with WPA/WPA2

So is there any reason not to enable OKC in all VSCs, for every client that can support it?

tx,

noemi

Ok, it's been several weeks now and everything actually seems to be going very well. I have had no issues roaming between my locations (subnets) in my network with my iPad. I don't know if the HP engineer that I had on the phone rectified something with some possible channel conflicts on the APs, but I have not addressed either of the two issues he pointed out to me that I would have to address over the summer, and roaming with my iPads has been fine. I am knocking the heck out of some wood right now typing this, but I seem to be living large right now. 

Dang it, I knew I spoke too soon. It's actually working too well now. My students have learned that they can use their network login account to setup wireless on their various phones (Android and iPhone) and have quickly used up all of my addresses in my DHCP scope.

Anyone have any ideas of what I can do to stop them from getting on my "Secure" network? We have school owned wireless devices that students need access to that they need their account to login with, so how do I stop them from doing the same on their personal devices?

Would any of these help or did you solve it another way?

Attachment(s)

HP MAc Auth.pdf   703 B 1 version

MAC auth.pdf   703 B 1 version

Sorry for not replying sooner, been tied up with several projects; but as it turned out, it was not the HP wireless the students were associating with... it was an old 3COM access point (open access) that somehow got plugged in on a mobile cart that's no longer used. We quickly turned that puppy off and took it for safe keeping. No more problems since.

When you say "this matter" to what are you referring?

There are well documented issues with wifi and the IPad2 and "new IPad"/IPad3.  If you google you will see many, many articles and KB articles both from the press and on Apple's site about how to resolve some of these issues.

What are you asking for a white paper to outline?

Thanks.

--glen

---

gglater wrote: What are you asking for a white paper to outline?

I think it would be helpful for HP to recommend best practices for iPad networks or iPad VSC's, as there are a myriad of MSM settings which are very difficult to determine what applies to mobile/handheld devices. It's one thing in a school with a laptop program, where the laptops are shutdown or put in standby when transported between classes, but iPads remain associated the entire day, no matter where they go, even in power save mode. The results are great, instant on, instant networking, and message/email notifications even in power save, but these devices are also all on the move at the same time between periods. Some guidance in configuring the network for the simplest roaming with the lowest drain on resources, something that is not easy to plan and test in the field, would be helpful. 

Our experience and the MSM system performance during our pilot program has not been great. In the fall I'll have 10 times as many iPads, and I am not looking forward to it.

I've used 802.1X with EAP/TLS authentication on HP wireless before, and with that, not only do you need a valid account, but you also need a certificate installed on the wireless devices handed down from your CA Authority. 

Or, you can use 802.1X with PEAP and still require that the cilent device TRUSTS the server certificate on the RADIUS server (and of this is generated from a local CA authority, it won't be trusted on the client by default, as its not on the trusted roots list)

Or, just switch to PSK?

JR