Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people, just like you, are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
Solved

Wireless Networking: Roaming between RADIUS secured base stations

Posted on 2014-02-11
2
466 Views
Last Modified: 2014-03-17
Hello wireless experts,

I have been tasked with extending the range of our RADIUS secured internal WLAN network.
I use Intellinet 300N access points, capable of four SSIDs combined with radius.

Simplified we have this setup:
Internal LAN, vlan1
Guest LAN, vlan100
DMZ, vlan101

Radius Backend: Windows Server 2008r2 with NPS role, Users from Active Directory.

Right now, I am using several 300N with the same SSID to span the DMZ (WPA2-PSK) and GUEST (WPA2-PSK) networks. Only one AP is used also for the INTERNAL Lan (WPA2-Enterprise), altogether hosting three SSIDs.

First of all, this setup is working and roaming between WPA2-PSK works as expected.

My thought was to put the third (RADIUS) SSID on the other AP's as well. I used a device and passphrase template in NPS for the devices and tested them all individually (working well).

The problem: Roaming is not stable. The client stays connected as long as the login AP stays in reach. Then it roams over and has no connection; roaming back to the original AP.
This continues until the connection is lost completely.

Also, it happens that some clients identify the wrong AUTH type for the network, say you want to connect to GUEST and are prompted to enter user / password combination (logs confirm the client sees a WPA2 Enterprise).

I hope it is just a misconfiguration or wrong assumption on my part. Or the AP's crap (working well without RADIUS)?

Thanks for the insight!
Helge
0
Comment
Question by:Daniel Helgenberger
2 Comments
 
LVL 45

Expert Comment

by:Craig Beck
ID: 39859025
It sounds like misconfiguration to be perfectly honest (if I understand the OP correctly).  The fact that the other SSIDs are working says the APs and RADIUS are fundamentally ok.
0
 
LVL 7

Accepted Solution

by:
bill30 earned 500 total points
ID: 39868149
There is a possible issue with roaming and authenticating before a timeout.  Radius authentication has more hoops to jump through than WPA-PSK authentiation.  At the bottom of the following article, it shows authentication rates based off of reduced connectivity conditions.  With Cisco you could do a debug showing you where you are running into trouble.  Looking at the manual didnt show much for Radius Authentication troubleshooting.

http://www.codealias.info/technotes/performance_of_eap_and_radius_authentication_in_roaming_scenarios

Also check to see if you are on the latest firmware on the AP's as that may help you with the roaming, but it looks like the last firmware update was 2011 on v1.05.  There is a possibility that these AP's will not handle roaming and Radius server authentication.
0

Featured Post

Easy, flexible multimedia distribution & control

Coming soon!  Ideal for large-scale A/V applications, ATEN's VM3200 Modular Matrix Switch is an all-in-one solution that simplifies video wall integration. Easily customize display layouts to see what you want, how you want it in 4k.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
mini spy rotating camera 3 75
keeping BYOD off corporate wireless 14 59
Some devices won't connect to AP 2 38
Dlink-DIR 816 router 4 20
In this article I will describe how to setup a Cisco WLC 5508 to work with Apple's Bonjour protocol across VLANs.  I will also discuss using screen mirroring and Airplay on an AppleTV v3.  This article covers the wireless network only and requires m…
This article is a step by step guide on how to create a basic PTP link using Ubiquiti airOS devices. This guide can be used on the following Ubiquiti AirMAX devices. Nanostation, Bullets, AirBridge, Nanobeam, NanoBridge to name a few. Please review …
This Micro Tutorial will show you how to maximize your wireless card to its maximum capability. This will be demonstrated using Intel(R) Centrino(R) Wireless-N 2230 wireless card on Windows 8 operating system.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question