HPE Aruba Networking & ProVision-based
1830241 Members
4001 Online
109999 Solutions
New Discussion

Re: random Client disconnections

 
Carlos_Fandango
Regular Visitor

random Client disconnections

I have a site which experience small 30 second outages and when I check the logs I see the following on ports on all 3 site switches. For example on one switch


I 08/18/20 15:27:06 00076 ports: port 18 is now on-line
I 08/18/20 15:31:48 00077 ports: port 18 is now off-line
I 08/18/20 15:31:52 00435 ports: port 18 is Blocked by AAA
I 08/18/20 15:31:52 00435 ports: port 18 is Blocked by STP
I 08/18/20 15:31:52 00435 ports: port 18 is Blocked by AAA
I 08/18/20 15:31:53 00435 ports: port 18 is Blocked by STP
I 08/18/20 15:31:55 00076 ports: port 18 is now on-line
I 08/18/20 15:37:53 00077 ports: port 16 is now off-line
I 08/18/20 15:37:57 00435 ports: port 16 is Blocked by AAA
I 08/18/20 15:37:57 00435 ports: port 16 is Blocked by STP
I 08/18/20 15:37:57 00435 ports: port 16 is Blocked by AAA
I 08/18/20 15:37:58 00435 ports: port 16 is Blocked by STP
I 08/18/20 15:38:00 00076 ports: port 16 is now on-line

interface 16
name "user 802.1X port"
untagged vlan 11
aaa port-access authenticator
aaa port-access authenticator auth-vid 11
aaa port-access authenticator unauth-vid 17
spanning-tree bpdu-protection
loop-protect
exit

FBRI-SW1# sh run int 18

Running configuration:

interface 18
name "user 802.1X port"
untagged vlan 11
aaa port-access authenticator
aaa port-access authenticator auth-vid 11
aaa port-access authenticator unauth-vid 17
spanning-tree bpdu-protection
loop-protect

 

4 REPLIES 4
Carlos_Fandango
Regular Visitor

Re: random Client disconnections

anyone had the same issue ? or any pointers?

Emil_G
HPE Pro

Re: random Client disconnections

Hello @Carlos_Fandango 

According to the log snippets the disconnection of the ports was shorter than 30 seconds, probably 30 seconds is the disconnection the end user experienced.

You see in the log messages indicating that port was blocked by AAA and by STP. This can lead to wrong conclusion that this protocols are blocking the port. In my opinion this is not true. The port is going down and then after a couple of seconds again up. When the port goes up it is blocked for another 3 of seconds by STP which need to check if BPDUs are received and what the port role in the STP topology should be. The port is also blocked by AAA in this case 802.1x which needs to perform an EAPOL exchange every time the port goes up in order to authenticate the user/machine.

So this procols add a couple of seconds to the offline time. In the spanning-tree configuration you can configure the port as admin-edge-port as explained here. This should reduce the duration of the disconnection.

https://community.arubanetworks.com/t5/Wired-Intelligent-Edge-Campus/How-are-the-Spanning-Tree-port-parameters-auto-edge-port-admin/ta-p/436335

Regarding 802.1x I am not sure that there is any option to reduce the time AAA is blocking the port, it probably also depends on the EAP method you are using.

Based on the log it is not possible to say what causes the disconnections in the first place. This could be physical issues. You can use the command show interface <int-nr> to check the statistics of the port. Pay attention to the section Errors (since boot or last clear). Feel free to paste the output here if necessary.

Use show interface brief <port-nr> to check the mode of the port, is it operating with 1000FDx, 100FDx, 100HDx. HDx or half duplex mode shouldnt be expected for todays devices so this may indicate duplex mismatch with the connected end-device. In this case you should make sure that you have exactly the same speed and duplex settings on the switch port and end device.

If you see the issue always on the same couple of ports and there are FCS or allignment errors there, you probably have HW issues. You should perform cross-testing in order to determine what component of the connection causes the disconnection. First you can replace the cable. Then you can swap the port of this device with a port of a known working end- device which doesnt have such disconnections. If the issue moves with the end device, the it is either cable , patch pannel or client NIC. If the issue stays with the port and all other components were replaced with known good and working ones, then it could be a problem with the port. You should check for errors, speed-duplex mode, check if your switch is running a current firmware version and update if it is not. If your cross-tests are showing clearly that the issue stays with the port and nothing of this helps you should contact the support for more troubleshooting.

I am an HPE employee

Accept or Kudo


Emil_G
HPE Pro

Re: random Client disconnections

Hello, 

Please provide feedback if my post has answered your question and was helpful in troubleshooting the disconnections! If so, mark it as resolved. If not feel free to share any new findings.

I am an HPE employee

Accept or Kudo


Carlos_Fandango
Regular Visitor

Re: random Client disconnections

Emil

We are still progressing with this call adn looking at possible NPS issues. Thanks for you guidance and I will update once we have further information.