topic Re: iPad reauthentication issue... in ZoneDirector

iPad reauthentication issue...

jason_barath — Tue, 10 Sep 2013 22:23:35 GMT

we have wi-fi setup at work using a zone director, and use guest access, with a hidden SSID, WPA-2 personal, and shared password. It is also setup so that the user must click on a terms and conditions page before using the Wi-Fi. This authentication expires after 8 hours.

Most of our devices have no issues, but most of our iPads seem to have this issue where, once they go to sleep, and the user turns the device on again, they have to re-authenticate every time.

Is there a way to prevent this behavior?

thanks,
jb

Re: iPad reauthentication issue...

sid_sok — Tue, 10 Sep 2013 22:35:34 GMT

Try changing the grace period. Change it to 8 hours or something longer then the default of 30 minutes. The other possible issue is that as the iPad is going to sleep it is sending a deauth to the AP. If it does the AP/ZD will remove the client's entry so it will have to re-auth when it comes back.

Re: iPad reauthentication issue...

dtsblake_588878 — Fri, 20 Sep 2013 11:58:09 GMT

Sid:

"...sending a deauth to the AP...."

What can I do to stop the "deauth?"

Our grace period is 8 hours and our ipads and iphones require reauthentication after they sleep.

Thanks, rb

Re: iPad reauthentication issue...

primoz_marinsek — Fri, 20 Sep 2013 12:58:21 GMT

There's really nothing you can do about it on an AP or ZD. If a STA wants to deauth, it will. It's not a request.

I've captured what my iPad does when it sleeps and I haven't seen any deauth frames. The only time I got a deauth frame was when I turned off WiFi on the iPad.

I'm running the last IOS 6. I'll upgrade to 7 over the weekend and see if it makes any difference.

Re: iPad reauthentication issue...

sid_sok — Fri, 20 Sep 2013 14:28:52 GMT

Primož Marinšek is correct, we can not stop a client from doing anything.

Once a client tell us that it's leaving the network (deauth) we will do the clean up procedure.

What you can do is to get some packet capture, macbooks running OS 10.8 or later, you can use the wifi-diagnostic to get some packet capture and see if this is the case. You can see the wifi-diagnostics if you hold down the Option key and click on the WiFi icon, on the bottom of the wifi list you will see wifi diagnostics. Once you get there you should be able to take a look at selection option to set the capture on a channel, set it to the channel the iPad is connected on and let the iPad go to sleep and see if it's sending the deauth or not.

Re: iPad reauthentication issue...

dtsblake_588878 — Fri, 20 Sep 2013 14:30:21 GMT

Based on your evidence, Sid's thought: " The other possible issue is that as the iPad is going to sleep it is sending a deauth to the AP" may not be accurate. Let us know if iOS 7 solves your problem. We also are in the process upgrading to 7.

Re: iPad reauthentication issue...

dtsblake_588878 — Fri, 20 Sep 2013 14:56:02 GMT

Sid:

Primož Marinšek also said: "I've captured what my iPad does when it sleeps and I haven't seen any deauth frames."

Side request: Can the ZD offer a global setting that allows the ZD admin to delay "the clean up procedure." for "#####" minutes?

ThX

Re: iPad reauthentication issue...

primoz_marinsek — Mon, 23 Sep 2013 08:46:11 GMT

I've done some tests with iOS7.

I've seen that the only time an iPad will send a Deauth frame is when you click on the WiFi OFF button in the Settings.

I've connected my iPAD to a particular SSID and left it for about an hour and there was no deauth packet. Which isn't very nice to the network in general, but it doesn't stand with your observation that it deauths every time it sleeps. But maybe my captures were wrong. Can someone else check this?

Basically what this is telling me is that iPAD really really want to be connected all the time. It's like the Borg, lost if not connected all the time.

RiX, are you shure iPads need to reauth when they sleep or if they go out of reach of your WLAN network and come back later? I've connected my iPad to my guest network also and left it to go to sleep, but I had no problem with the reauth. I don't have grace period set at all.

Re: iPad reauthentication issue...

sid_sok — Mon, 23 Sep 2013 18:35:22 GMT

As long as clients are not disconnected after the Grace period and not sending a deauth, it should remain in Authorized state so would not need to be sent to the "login" just the T&C page here. One other possibility is that the client might be connecting to another network (if you have multiple wlan setup) then coming back to the T&C wlan?

This may need to be troubleshot live with support to get to the bottom of this.

Re: iPad reauthentication issue...

dtsblake_588878 — Mon, 23 Sep 2013 18:55:58 GMT

May try support after a few more work-around attempts.

Are there any iOS and/or OSX ruckus users out there that are not having any problems with disconnects?

Thanks Sid.

Re: iPad reauthentication issue...

primoz_marinsek — Tue, 24 Sep 2013 05:41:52 GMT

I didn't have any problems with this in the office.

But as I said before and what Sid was asking. Maybe clients are connecting to different SSIDs and are sending Deauth on the SSID they were connected to.

Have you checked that?

Re: iPad reauthentication issue...

dtsblake_588878 — Tue, 24 Sep 2013 10:31:45 GMT

Thank you Primož Marinšek. We are performing several more tests to make sure the SSID is not the culprit. Will reply after additional testing this week.

Re: iPad reauthentication issue...

dtsblake_588878 — Wed, 25 Sep 2013 12:58:56 GMT

For the WLAN in question, we unselected "Hotspot Service (WISPr)" and selected "Regular Usage" and we are experiencing less premature disconnects. After 24-hours of testing, so far so good. Will test for 5-7 more days before I will claim "work-around" works for us. (ZD 3000 - 9.6.1.0 build 15)

Re: iPad reauthentication issue...

dtsblake_588878 — Thu, 07 Nov 2013 18:50:20 GMT

iPad w/ iOS 7 requires login credentials after every iPad idle sleep.

Passcode is retained but HotSpot AD credentials are required again and again and again....after every few minutes or so.

Any thoughts?

Re: iPad reauthentication issue...

keith_redfield — Thu, 07 Nov 2013 19:30:55 GMT

I think this is related to some GUI..ahem..opportunities.

It seems this checkbox:

doesn't do what you might assume (which is that if un-checked there is no timeout). On the contrary..it appears that if that box is not checked, then no state is maintained of the associations.

So...check the Grace Period box and set a reasonable value. See if that helps.

Re: iPad reauthentication issue...

dtsblake_588878 — Thu, 07 Nov 2013 19:41:15 GMT

Keith:

Now set grace to "60" and checked.
Set Inactivity to "120."

Re: iPad reauthentication issue...

dtsblake_588878 — Thu, 07 Nov 2013 19:59:52 GMT

Anyone???

More symptoms...iPad (iOS 7) while in use (see pics below) the iPad does not move from office location while person is using chrome browser. No other Ruckus APs closer than 300 meters. Exisiting connected AP is within 25 feet of iPad. Roams within same AP 11a/n to 11g/n. Hotspot login page is then sent to active client while they are browsing general Internet website.

Re: iPad reauthentication issue...

scott_hudson_61 — Tue, 12 Nov 2013 15:17:52 GMT

We had this here in the school and it turned out to the ruckus authentication logon box which was the issue, we changed our smoothwall server so that al lthe staff ipads wer classed as unautheticated ip's and set up appropriate filtering and turned off the ruckus logon box, we no longer have the issue now.

But if you want the logon box try this (not a long term fix but does work)

turn airplane mode on and click wifi always on it works, what we found here was that ipads go to sleep and thus they kill all non essential power, so when you 'wake' up the ipad its as if it has just entered the wifi zone and need to reconnect/authorize via the ruckus logon box.

Also ipads are notorious for 'hanging' on to the connected AP as long as possible which causes roaming issues.

Remember these are just my findings.

Re: iPad reauthentication issue...

dtsblake_588878 — Thu, 14 Nov 2013 13:43:29 GMT

Set grace and inactivity each to 120 but it did not help.

Re: iPad reauthentication issue...

dtsblake_588878 — Thu, 14 Nov 2013 13:45:16 GMT

The problem has returned. Work-arounds not lasting for us. Any hope of a more permanent solution from Ruckus?