Best Practices: Wireless network on a Windows domain that includes Mac workstations.

Trying to setup a wireless network in a Windows Server 2003 domain that includes Mac workstations. I have three Netgear wireless access points. One is actually a wireless router configured as an access point (NAT turned off), the other two are access points only. We also have a "Guest" wireless router that I have no trouble with, presumably because devices get an IP on the router's LAN, not our domain.

For over a year we have been experiencing problems keeping devices connected. The connections would be dropped without warning or indication. The indicator never changes, shows full bars. You would be surfing and then "page not found". Turning off wireless adapters and turning them back on generally fixes the problem...for a short time anyway. Sometimes rebooting the nearest AP is necessary.

Today I tried resetting each access point to factory and starting over. I give each device a unique static IP on the domain that is outside the range of the DHCP sever's pool. I also set reservations for them in DHCP. Don't know if that's necessary.

Ideally, I want to be able to move throughout the building and be automatically connected to the nearest AP. It doesn't happen. In the basement, I'm still connected to the 4th floor AP even though I have an AP 20 feet away. I've given each AP the same SSID. All use the same encryption and security configuration. All ethernet cables to the access points run back to the main switch where the rest of the computers are plugged in.

Still cannot maintain a consistent connection. It behaves like there are perhaps IP conflicts happening. I am assuming that a device connecting to an AP gets an IP address from the pool on the DHCP server. Networking is not my strong suit.

Should all the APs be connected to the switch or should there be a master Wireless router and all APs connect to it?

Or is this a Mac problem?

Any help would be appreciated.
LVL 38
Tom BeckAsked:
Who is Participating?
 
strungCommented:
Try setting the AP's channels to 1, 6 and 11, rather than Auto, and see if that makes a difference
0
 
Thomas GrassiSystems AdministratorCommented:
1. No need for a Master Wireless router best to keep them connected to the switch directly.
2. Are you just having this problem with MAC's?
3. If so what OS are they?
4. Any other wireless device having this issue?
5. What WiFi frequency you using?  
6. What channel?

Just a few of the top of my head
0
 
strungCommented:
When you assigned static IP's to the AP's, did you make sure they were on the same subnet as the DHCP server, but outside the range served up by the DHCP server? If not, you may be getting IP conflicts.

For instance, if the DHCP server is 192.168.1.1 and serves up IP from 192.168.1.100 to 192.168.1.200, your AP's would have to be in the range 192.168.1.2 to 192.168.1.99 or 192.168.1.201 to 192.168.1.254.
0
How do you know if your security is working?

Protecting your business doesn’t have to mean sifting through endless alerts and notifications. With WatchGuard Total Security Suite, you can feel confident that your business is secure, meaning you can get back to the things that have been sitting on your to-do list.

 
Tom BeckAuthor Commented:
Only iMacs, MacBooks, iPhones, and iPads trying to connect wirelessly. No Windows devices have wireless. All devices not hard wired experience the same trouble. Macs are either 10.7.3 or 10.10.2. iPhones have the latest iOS.

All channels set to "auto", channel width, 20MHz. All are 2.4GHz bandwidth.

DHCP server pool is 10.0.0.60 to 10.0.0.125. Access Points are 10.0.0.140 to 10.0.0.143. When I successfully connect, I get an IP within the range of the DHCP pool.
0
 
Thomas GrassiSystems AdministratorCommented:
When trying to connect they are having issue connecting to the DHCP server

A way to prove this is run wire Shark on a laptop or MAC and trace look for acknowledgements  from the device failing to connect will give you a glue what is wrong

I had a similar problem on my home network but only certain devices were failing.
0
 
Tom BeckAuthor Commented:
having issue connecting to the DHCP server
You mean long after they obtain an IP address from the DHCP, they can have trouble reconnecting to the DHCP? Or could it be trouble with DNS which goes through the same server? Still, the hard wired devices have no trouble.

I was considering Wireshark. I'll give that a try.
0
 
Thomas GrassiSystems AdministratorCommented:
Yes

Make sure your dhcp scope has the correct settings

Wire shark is a great tool
0
 
Tom BeckAuthor Commented:
How accurate is the information OS X provides for the wireless connection? I just find it hard to believe that after disconnecting and reconnecting to Westview on my laptop that I still connect to the 4th floor AP (based on MAC address) when there's another AP 20 feet away that my iPhone is currently connected to.
Westview
0
 
strungCommented:
When you click on the wireless icon in the menubar, does it show more than one entry for Westview. Since you have 3 AP's I would think there should be three entries, one for each AP.

In any case, try setting the channels manually to 1, 6 and 11 and see what happens. You will be able to tell from the channel number pretty quickly which AP you are connected to.
0
 
Tom BeckAuthor Commented:
I can try the channel change thing tomorrow. Sounds promising.

I am not broadcasting Westview on any of the APs so they are not in the list.
0
 
Craig BeckCommented:
There will only be one SSID visible if all APs use the same SSID/authentication/encryption settings.

The client in your example has a good signal from that AP.  Generally speaking it will associate to the first AP that responds to its probe.  If it happens to be the furthest AP from it, the client doesn't care.  It will have a set of thresholds which dictate things like suitable association candidate and roaming aggressiveness.  As long as those thresholds aren't breached the client may just want to stick where it is.

Using RADIUS is how clients usually roam seamlessly between APs.  If you just have 3 APs all using the same preshared key the client will have to do a full authentication whenever it moves to another AP (unless you use WDS).  With RADIUS the authentication session is maintained; all that happens is the AP gets the OK quicker from the RADIUS server to allow the client to connect, so the whole association/authentication process is a lot quicker.

I'd say get it all working using preshared keys first, then make it more complex with RADIUS if that's what you want to do.  Doing it that way will allow you to test the underlying services a lot more easily (DHCP, VLANs, etc).
0
 
Tom BeckAuthor Commented:
Thanks for that information Craig. I didn't know all that.

Does it matter that I am not broadcasting the SSIDs?

As you may remember from my last question, I spent three days trying to get RADIUS working and decided to abandon the idea. Never even wirelessly connected one device successfully.

I have a wireless network setup at the boss's house. There's no domain controller. The Sonicwall firewall handles DHCP. There are probably seven Access Points there (13,000 sq ft house). I can move from room to room and be connected from one AP to the next seamlessly. All Apple devices there too, Netgear APs.
0
 
Thomas GrassiSystems AdministratorCommented:
We use Cisco Meraki equipment and have many AP's throughout our complex and we get connected to the closest AP when moving we do not use Radius, Also the AP's mess together.

the also give 5ghz which has less noise as the 2.6 ghz does.

I think changing the channels might help too
0
 
Craig BeckCommented:
@trgrassijr55 - I think you meant 2.4GHz :-)

You have to remember that not all devices support 5GHz too, so using a pure 5GHz environment isn't the best advice really.

Where a controller is used RADIUS isn't a requirement in order to achieve seamless roaming, but there's no mention of a controller in the OP, so RADIUS is worth mentioning.

As I said previously, thresholds can influence roaming decisions at the client, but also at the AP too.

Changing the channels on the APs (or rather manually setting them) will help.  Each AP should use a different channel and no more than 3 should be able to 'see' each other when using the 2.4GHz band.
0
 
Tom BeckAuthor Commented:
I now have two routers on the guest wireless network. I gave each a different range of IP addresses in their respective DHCP pools from the same subnet. I can move seamlessly between them and get connected to the nearest one. They are on channels 3 and 9

The three access points are on channels 1, 6 and 11 as @Strung suggested. I am connecting to the APs more quickly now. I still cannot roam seamlessly between them. My laptop still insists on connecting to the 4th floor AP when I'm in the basement. I suppose it's like @craigbeck says, it will connect to the first one that responds. I wonder though if it's because the assigned IP addresses are coming from the same central DHCP server pool rather than separate pools like they do on the guest wireless network. On the guest wireless there's a forced switch to a different IP assignment.

The fact that I am able to connect more quickly leads me to believe the connection will be more stable too. Time will tell. If I can stay connected for the rest of the day I will call it solved. I've got Wireshark going. If the connection fails I can hope for a clue.
0
 
Tom BeckAuthor Commented:
New thought. Is it possible that my APs are just not spread out far enough? Maybe connecting devices cannot distinguish the differences in signal strength between a near one (basement) and a far one (4th floor).

Another one. Could it have anything to do with the fact that I am not broadcasting the network SSIDs?
0
 
Craig BeckCommented:
I suppose it's like @craigbeck says, it will connect to the first one that responds.
Yes and no.  Yes, the client probably connected to that AP because it was the first one to respond to a probe, but if the client moves that AP may still be providing a signal which hasn't triggered the client's roam threshold action.  If the client can still get a good signal from the first AP, even though there's one a lot closer, why should it move just for that reason?  It's more disruptive to move between APs than it is to just stay connected to the one you're currently on.

The thing to remember is that you don't necessarily have to connect to the closest AP.
0
 
Tom BeckAuthor Commented:
which hasn't triggered the client's roam threshold action
Like:
Maybe connecting devices cannot distinguish the differences in signal strength between a near one (basement) and a far one (4th floor)
0
 
Craig BeckCommented:
Not really.

If the AP on the 4th floor (the original AP) is still giving the client a signal of -64dBm, while the basement AP is giving a signal of -45dBm, the client may decide that the 4th floor AP is still good.  It will be able to distinguish the difference, but it decides that the signal is still fine, so no need to move.

Now, let's say the client can see the 4th floor AP with a signal of -81dBm and the basement AP with a signal of -58dBm (all random values btw) the client's roam threshold might be set to -80dBm... then it would decide to move to the basement AP because its signal is within the threshold and therefore a better choice.
0
 
Tom BeckAuthor Commented:
@craigbeck, thanks for all the insights. I believe you are correct that it is not automatically switching between APs as I move throughout the building because the thresholds for switching are not being met.

@trgrassijr55, thanks for the WireShark idea. I actually found another unrelated problem on the network as a result of running WireShark that I was not aware of. I  opened another question to deal with that.

@strung, I believe that setting the channels to 1, 6 and 11 for the three APs solved the issue of maintaining an uninterrupted wireless connection throughout the day. Still monitoring.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.