WLC 4402 slow authentication

[james-mccarthy]

We just upgraded to software version 4.2.61.0 and some users are experiencing very long delays during authentication. We use 8021x with RADIUS authentication. When they log into the computer, it hangs for about 60 seconds after entering the password. After that it will hang at the "applying computer settings" screen for anywhere from 10 minutes to forever. This does not happen if the computer is plugged into the wired network. It's random. I can move the AP's to the other controller and it will work for a day or two and then start acting up again. I move them back to the primary controller and it is ok for a day or two. I can't seem to figure this out so I thought I'd get some input from you guys since you have always been a great deal of help.

Thanks

James

EDIT: after the upgrade we have been receiving TONS of MFP anomally detections and Broadcast Deauth events......could this be related?

[Scott Fella]

Try setting the timeout to 30:

config advanced eap identity-request-timeout 30 and disable MFP.

[james-mccarthy]

I'll try that right now....The problem is that it is a random occurence. Most laptops have no problems but a few just refuse to connect. I'll let you know what I come up with.

Thanks

[Scott Fella]

if few refuse to connect, do you mean that it never was able to. Verify that you have the latest drivers on the client side and if using some old devices, make sure you have data rates 1mb and 2.2mb set as mandatory, which is required on some of the legacy devices. This is also required on the Intel 2200 wifi cards with old drivers.

[james-mccarthy]

First off, in your first post, did you want me to disable the MFP infrastructure or disable MFP Frame Validation on the AP?

And all of our laptops are identical with the same driver for the intel 2915ABG ProWireless. All the laptops have the same XP Pro image.

Someone had a laptop yesterday that wouldn't connect. It had the problem I stated earlier. As soon as I moved it to a different AP on a different controller, it worked. So I moved all 38 AP's over to that controller and everything was fine until today. There are two other computers that can't log on. It's very random.

Thanks for all your help. I have already disabled MFP Infrastructure and set the timeout to 30. I'll post with more info....

[Scott Fella · Accepted solution]

In the Security tab under Wireless Protection Policies | AP Authentication / MFP, Protection Type set to none for now. How do you have your WLC setup... primary and backup or are the two spliting the load? What radius server are you running and how many? What do you see in the logs in the radius server?

[james-mccarthy]

they are splitting the load technically. If I restart either controller all the AP's default to the other one and stay there. But I've been testing the wireless after I disabled MFP and it seems to be working. I tested a laptop on 10 random AP's and it worked fine.

But under the AP Authentication section, it was set to AP authentication and not MFP. I just disabled MFP per WLAN earlier.

EDIT: We have two radius servers and I don't have access to the logs. The server guy went home hours ago.

[Scott Fella]

The reason I asked about how many ACS, is because depending on which one the user hits, their might be an issue. How are you syncing the database between the two? I would set the radius on the WLC to only one ACS and veify that ACS is fine and then vice versa to eliminate ACS issues. Take a look at the pass attemps and failed attempts. You might have to enable this logging if you do not see any logs.