topic Re: Migrate to PA firewall cause WIFI roaming issue in General Topics

Migrate to PA firewall cause WIFI roaming issue

Fariq_Zaidi — Mon, 18 Sep 2023 03:54:33 GMT

Hi Support,

We just recently migrate the PA Firewall from cisco firewall. PA Firewall will act as gateway and provide DHCP.
however we counter issue with roaming WIFI where client connected to AP A and change location to AP B without disconnect causing loss internet connection. We don't see any drop at all in firewall logs. so we not sure how to troubleshoot this. as previously cisco firewall is working fine with WIFI roaming. The WLC and AP we use Ruckus vendor (virtual smartZone)

Any idea, or experience on similar issue much appreciate if you can share with us.

Thank you

Re: Migrate to PA firewall cause WIFI roaming issue

reaper — Mon, 18 Sep 2023 13:50:20 GMT

how are both your AP connected in relation to the firewall? do they 'join' in the middle on a switch or are they plugged into their own respective port on the firewall?

does the user retain the same IP when hopping AP? you could try running a filtered packet-diag to see what is happening once they hop

debug dataplane packet-diag clear all debug dataplane packet-diag set filter match source x.x.x.x debug dataplane packet-diag set filter on show counter global filter delta yes packet-filter yes

run that last command several times during the transition to see if any drop counters pop up

Re: Migrate to PA firewall cause WIFI roaming issue

RaulTrujillo — Mon, 18 Sep 2023 20:27:58 GMT

Hmm,

I have a similar setup with Ruckus and having issues. I kept thinking it was my Ruckus configuration. I'll keep an eye on this post.

Raul Trujillo

Re: Migrate to PA firewall cause WIFI roaming issue

Fariq_Zaidi — Tue, 26 Sep 2023 09:04:45 GMT

Hi Tom

Thank you for input.

1. how are both your AP connected in relation to the firewall? do they 'join' in the middle on a switch or are they plugged into their own respective port on the firewall?
-- The AP is connected to the switch but not directly into firewall port. They connected to the switch that had another uplink until their packet arrived at firewall. Maybe we can call it ' join' in the midlle ?

2. does the user retain the same IP when hopping AP?
-- yes, the user retain the same IP when hopping AP

3. i am collecting the packet diag but Should the x.x.x.x filled with my AP ip subnet ? for example 192.168.24.0 ?

Thank you

Fariq