iPad reauthentication issue...

  • 8
  • Question
  • Updated 3 years ago
  • Answered
we have wi-fi setup at work using a zone director, and use guest access, with a hidden SSID, WPA-2 personal, and shared password. It is also setup so that the user must click on a terms and conditions page before using the Wi-Fi. This authentication expires after 8 hours.

Most of our devices have no issues, but most of our iPads seem to have this issue where, once they go to sleep, and the user turns the device on again, they have to re-authenticate every time.

Is there a way to prevent this behavior?

thanks,
jb
Photo of jason barath

jason barath

  • 1 Post
  • 0 Reply Likes

Posted 4 years ago

  • 8
Photo of Sid Sok

Sid Sok, Official Rep

  • 102 Posts
  • 48 Reply Likes
Try changing the grace period. Change it to 8 hours or something longer then the default of 30 minutes. The other possible issue is that as the iPad is going to sleep it is sending a deauth to the AP. If it does the AP/ZD will remove the client's entry so it will have to re-auth when it comes back.
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
Sid:

"...sending a deauth to the AP...."

What can I do to stop the "deauth?"

Our grace period is 8 hours and our ipads and iphones require reauthentication after they sleep.

Thanks, rb
Photo of Primož Marinšek

Primož Marinšek, AlphaDog

  • 413 Posts
  • 48 Reply Likes
There's really nothing you can do about it on an AP or ZD. If a STA wants to deauth, it will. It's not a request.

I've captured what my iPad does when it sleeps and I haven't seen any deauth frames. The only time I got a deauth frame was when I turned off WiFi on the iPad.

I'm running the last IOS 6. I'll upgrade to 7 over the weekend and see if it makes any difference.
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
Based on your evidence, Sid's thought: " The other possible issue is that as the iPad is going to sleep it is sending a deauth to the AP" may not be accurate. Let us know if iOS 7 solves your problem. We also are in the process upgrading to 7.
Photo of Sid Sok

Sid Sok, Official Rep

  • 102 Posts
  • 48 Reply Likes
Primož Marinšek is correct, we can not stop a client from doing anything.

Once a client tell us that it's leaving the network (deauth) we will do the clean up procedure.

What you can do is to get some packet capture, macbooks running OS 10.8 or later, you can use the wifi-diagnostic to get some packet capture and see if this is the case. You can see the wifi-diagnostics if you hold down the Option key and click on the WiFi icon, on the bottom of the wifi list you will see wifi diagnostics. Once you get there you should be able to take a look at selection option to set the capture on a channel, set it to the channel the iPad is connected on and let the iPad go to sleep and see if it's sending the deauth or not.
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
Sid:

Primož Marinšek also said: "I've captured what my iPad does when it sleeps and I haven't seen any deauth frames."

Side request: Can the ZD offer a global setting that allows the ZD admin to delay "the clean up procedure." for "#####" minutes?

ThX
Photo of Primož Marinšek

Primož Marinšek, AlphaDog

  • 413 Posts
  • 48 Reply Likes
I've done some tests with iOS7.

I've seen that the only time an iPad will send a Deauth frame is when you click on the WiFi OFF button in the Settings.

I've connected my iPAD to a particular SSID and left it for about an hour and there was no deauth packet. Which isn't very nice to the network in general, but it doesn't stand with your observation that it deauths every time it sleeps. But maybe my captures were wrong. Can someone else check this?

Basically what this is telling me is that iPAD really really want to be connected all the time. It's like the Borg, lost if not connected all the time.

RiX, are you shure iPads need to reauth when they sleep or if they go out of reach of your WLAN network and come back later? I've connected my iPad to my guest network also and left it to go to sleep, but I had no problem with the reauth. I don't have grace period set at all.
Photo of Sid Sok

Sid Sok, Official Rep

  • 102 Posts
  • 48 Reply Likes
As long as clients are not disconnected after the Grace period and not sending a deauth, it should remain in Authorized state so would not need to be sent to the "login" just the T&C page here. One other possibility is that the client might be connecting to another network (if you have multiple wlan setup) then coming back to the T&C wlan?

This may need to be troubleshot live with support to get to the bottom of this.
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
May try support after a few more work-around attempts.

Are there any iOS and/or OSX ruckus users out there that are not having any problems with disconnects?

Thanks Sid.
Photo of Primož Marinšek

Primož Marinšek, AlphaDog

  • 413 Posts
  • 48 Reply Likes
I didn't have any problems with this in the office.

But as I said before and what Sid was asking. Maybe clients are connecting to different SSIDs and are sending Deauth on the SSID they were connected to.

Have you checked that?
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
Thank you Primož Marinšek. We are performing several more tests to make sure the SSID is not the culprit. Will reply after additional testing this week.
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
For the WLAN in question, we unselected "Hotspot Service (WISPr)" and selected "Regular Usage" and we are experiencing less premature disconnects. After 24-hours of testing, so far so good. Will test for 5-7 more days before I will claim "work-around" works for us. (ZD 3000 - 9.6.1.0 build 15)
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
The problem has returned. Work-arounds not lasting for us. Any hope of a more permanent solution from Ruckus?
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
iPad w/ iOS 7 requires login credentials after every iPad idle sleep.

Passcode is retained but HotSpot AD credentials are required again and again and again....after every few minutes or so.

Any thoughts?
Photo of Keith - Pack Leader

Keith - Pack Leader

  • 860 Posts
  • 51 Reply Likes
I think this is related to some GUI..ahem..opportunities.

It seems this checkbox:

doesn't do what you might assume (which is that if un-checked there is no timeout). On the contrary..it appears that if that box is not checked, then no state is maintained of the associations.

So...check the Grace Period box and set a reasonable value. See if that helps.
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
Set grace and inactivity each to 120 but it did not help.
Photo of Ed

Ed

  • 16 Posts
  • 0 Reply Likes
i have the same issue, when the iphone, ipod, ipad lock's we need to reutenticate the device even with the profile of the Zero IT.

WLAN is for Standard Usage , so i dont have this grace period and the Inactivity Timeout its set to 500 minutes.
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
Keith:

Now set grace to "60" and checked.
Set Inactivity to "120."
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
Anyone???

More symptoms...iPad (iOS 7) while in use (see pics below) the iPad does not move from office location while person is using chrome browser. No other Ruckus APs closer than 300 meters. Exisiting connected AP is within 25 feet of iPad. Roams within same AP 11a/n to 11g/n. Hotspot login page is then sent to active client while they are browsing general Internet website.



Photo of Scott Hudson

Scott Hudson

  • 16 Posts
  • 1 Reply Like
We had this here in the school and it turned out to the ruckus authentication logon box which was the issue, we changed our smoothwall server so that al lthe staff ipads wer classed as unautheticated ip's and set up appropriate filtering and turned off the ruckus logon box, we no longer have the issue now.

But if you want the logon box try this (not a long term fix but does work)

turn airplane mode on and click wifi always on it works, what we found here was that ipads go to sleep and thus they kill all non essential power, so when you 'wake' up the ipad its as if it has just entered the wifi zone and need to reconnect/authorize via the ruckus logon box.

Also ipads are notorious for 'hanging' on to the connected AP as long as possible which causes roaming issues.

Remember these are just my findings.
Photo of Scott Hudson

Scott Hudson

  • 16 Posts
  • 1 Reply Like
here on ruckus ap zf7363 using ios6/7 but its not that much of an issue here as we are completely covered so it just picks up when out of range
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
Scott: Are you using any built-in Ruckus authentication? We have many zf7982's (one ZD3000) with more than ample coverage. Many of our iPads must re-authenticate via embedded hotspot and they have not moved from one part of an office to another within a distance of 10 feet.
Photo of Scott Hudson

Scott Hudson

  • 16 Posts
  • 1 Reply Like
not now we turned it off staff use a unauthenticated ip range filter on our proxy server and students use the proxy server/internet filter account which is linked to Active Directory.
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
At least one other mentioned that they "work around" ruckus authentication / re-authentication problems by using a proxy system. Part of the reason we purchased Ruckus was the built-in functions.

Do you use a specific proxy server?

Thanks
Photo of Scott Hudson

Scott Hudson

  • 16 Posts
  • 1 Reply Like
smoothwall UTM, you wil lfind that it appears to just ipads that have this issue we have tested with android and windows and laptops/netbooks all of these other devices did not appear to be affected by this.
Photo of Keith - Pack Leader

Keith - Pack Leader

  • 860 Posts
  • 51 Reply Likes
We've been able to re-produce and have filed a bug against the re-authentication issue when the client roams across channels (2.4Ghz to 5Ghz)
Photo of ThX

ThX

  • 128 Posts
  • 2 Reply Likes
Much appreciated Keith, most vendors do not participate "officially" and in this manner in customer forums.

Will someone @Ruckus announce where and when the "patch" is available?

Based on my ZD3000 logs, this 2.4 to 5 problem is the most consistent reason that my iPad / iPhone users must re-authenticate. These folks are my noisiest "opinionators."

Thanks.
Photo of Robert

Robert

  • 8 Posts
  • 0 Reply Likes
How can I tell if a client is connected with 5ghz or 2.4ghz and when they roam between them?
Photo of Keith - Pack Leader

Keith - Pack Leader

  • 860 Posts
  • 50 Reply Likes
This is a great conversation that's separate from the main topic, so I created a new topic to continue the discussion. Please reference the new topic here: How can I tell if a client is connected with 5ghz or 2.4ghz and when they roam be...
Photo of Robert

Robert

  • 8 Posts
  • 1 Reply Like
Not sure if it's related or not but I have had regular laptop users having to re-authenticate as well. The issue seemed to be related to Channel Fly on the 5ghz band. I turned off channel fly and the problem went away. I replied to this topic as well. https://forums.ruckuswireless.com/ruc...
Photo of Michael Brado

Michael Brado, Official Rep

  • 2116 Posts
  • 297 Reply Likes
With regard to iPad re-authentication issues related to HotSpot or Guest Access WLANs, do increase the grace period (not found on non-webauth WLANs), and
also check Auto-Join and Auto-Login option under the WLAN profile on the iPads.

Photo of Com1 NL - Bas Sanders

Com1 NL - Bas Sanders

  • 32 Posts
  • 9 Reply Likes
@Primož Marinšek, we have seen similar results but noticed that both iPhones and iPads act differently when they are connected to a powersource.

My iPhone disconnects as soon as the phone enters 'standby mode'. As soon as i enable my phone it will reconnect.
Photo of Primož Marinšek

Primož Marinšek, AlphaDog

  • 413 Posts
  • 48 Reply Likes
Thanks for sharing your findings. I can only test with an iPad since it's the only iThingy I have :)