It's been over a year since my last blog post... Not good.
I'm back again, however, listing some of the timeout settings that can cause issues on WLANs. There are five infrastructure timeout values that may affect users who connect to a WLAN, depending on how and where they are connecting. These are:
1. Arp Time to Live
Deletes ARP entries on the WLC for the devices learned from the network. Increasing this timeout increases the CPU load and distorts statistics for the number of simultaneous users. The default value is 300 seconds (5 minutes). The command applies to all WLANs on the WLC. Configured at Controller > General > ARP Timeout.
2. Session Timeout
When a user is idle without any communication with the LAP for the amount of time set as User Idle Timeout, the client is de-authenticated by the WLC. The client has to re-authenticate and re-associate to the WLC. It is used in situations where a client can drop out from its associated LAP without notifying the LAP. This can occur if the battery goes dead on the client or the client associates move away. Increasing the user idle timeout utilizes more RAM on the WLC and will make the WLC client database less accurate. Default is 300 seconds (5 minutes). The command is specified per WLAN. Configure at WLANs > WLAN ID > Advanced > Enable Session Timeout.
3. User Idle Timeout
This setting is the maximum time for a client session with the WLC. After this time, WLC de-authenticates the client, and the client goes through the whole authentication (re-authentication) process again. This is a part of a security precaution to rotate the encryption keys. Increasing the user idle timeout utilizes more RAM on the WLC and will make the WLC client database less accurate. Default is 1800 seconds (30 minutes). The command applies globally to the WLC. Configured at Controller > General > User Idle Timeout.
4. Broadcast Key Interval
When a user connects to the WLAN, they receive a broadcast key. If 802.1x authentication is in place, this key allows for encryption of broadcast/multicast traffic to the client. Increasing the timer has a slightly detrimental effect on WLAN security, as a nefarious user who manages to decrypt the key would gain access to a larger data set. Default is 3600 seconds (1 hour). This setting applies to all WLANs on the WLC. Configured via CLI: config advanced eap bcast-key-interval x, where x is a value between 120 and 86400.
5. DHCP Lease Time
The DHCP lease specifies the amount of time a given client may utilize a dynamically assigned IP address. Increasing the value can create DHCP scope depletion, where all IP addresses in the scope are assigned to clients even though those clients are no longer active on the network. Default on Cisco routers/switches is 1 day. This applies to all clients on the scope.
In addition, other timeouts need to be considered:
6. Device Timeout
All WLAN client devices have their own settings for determining when and how to disassociate from a WLAN or disable their wNIC. This is normally done to conserve battery power and/or increase device security. These default values are device-dependent.
7. Other Timeouts
There are many other timeout values that can affect the wireless user experience. Among these are VPN timers, RADIUS timeout values (when utilizing 802.1x), and various client application settings (browser timeouts, sleep settings, power settings, etc.). Determining the exact cause of a timeout for a specific group of users may require consideration of these values.
The MU to MU disallow feature allows the RF Switch to block communications exchanged between clients associated to a WLAN.With the Motorola ...
Pre-Requisites: Requirements: The following requirements must be met prior to attempting this configuration: One (or more) RF Switc...
LDAP Server can be used as the database with WS5100 radius server. This document provides the details of configuration need to done for WS5...
RADIUS Authentication Attributes: The RADIUS protocol follows client-server architecture and uses the User Datagram Protocol (UDP) as de...
WS5100 login: cli User Access Verification Username: restore Password: restoreDefaultPassword WARNING:This will wipe out the con...
IPSec VPN offers the security and encryption features necessary to protect enterprise data, voice, and video traffic as it traverses public...
Use of ARP Cache in a network device Most of the network devices will have anARP cache; the content of the same will be a collection of IP...
Requirements: The following requirements must be met prior to attempting this configuration: One RFS4000 or RFS6000 WLAN Switch Contr...
Components Used: The information in this document is based on the following hardware and software versions: · 1 x RFS4000 Swit...
Components Used: The information in this document is based on the following Motorola hardware and software versions: 1 x RFS6000 or ...
Requirements: The following requirements must be met prior to attempting this configuration: One RFS4000 or RFS6000 WLAN Switch Contr...
RADIUS Authentication Attributes: The RADIUS protocol follows client-server architecture and uses the User Datagram Protocol (UDP) as de...
The Motorola Hotspot authentication feature offers a simple way to provide secure authenticated access on a WLAN for users and devices usin...
WS5100 login: cli User Access Verification Username: restore Password: restoreDefaultPassword WARNING:This will wipe out the con...
Smart ( S elf M onitoring A t R un T ime) RF: • Next generation RF Management feature • Selects the optimal initial c...
Use of ARP Cache in a network device Most of the network devices will have anARP cache; the content of the same will be a collection of IP...
LDAP Server can be used as the database with WS5100 radius server. This document provides the details of configuration need to done for WS5...
The MU to MU disallow feature allows the RF Switch to block communications exchanged between clients associated to a WLAN.With the Motorola ...