Migrate to PA firewall cause WIFI roaming issue

[Fariq_Zaidi]

Hi Support,

We just recently migrate the PA Firewall from cisco firewall. PA Firewall will act as gateway and provide DHCP.
however we counter issue with roaming WIFI where client connected to AP A and change location to AP B without disconnect causing loss internet connection. We don't see any drop at all in firewall logs. so we not sure how to troubleshoot this.  as previously cisco firewall is working fine with WIFI roaming.  The WLC and AP we use Ruckus vendor (virtual smartZone)

Any idea, or experience on similar issue much appreciate if you can share with us.

Thank you

[reaper]

how are both your AP connected in relation to the firewall? do they 'join' in the middle on a switch or are they plugged into their own respective port on the firewall?

does the user retain the same IP when hopping AP? you could try running a filtered packet-diag to see what is happening once they hop

debug dataplane packet-diag clear all  
debug dataplane packet-diag set filter match source x.x.x.x
debug dataplane packet-diag set filter on

show counter global filter delta yes packet-filter yes 

run that last command several times during the transition to see if any drop counters pop up 

[RaulTrujillo]

Hmm,

I have a similar setup with Ruckus and having issues.  I kept thinking it was my Ruckus configuration.  I'll keep an eye on this post.

Raul Trujillo

[Fariq_Zaidi]

Hi Tom 

Thank you for input.

1. how are both your AP connected in relation to the firewall? do they 'join' in the middle on a switch or are they plugged into their own respective port on the firewall?
-- The AP is connected to the switch but not directly into firewall port. They connected to the switch that had another uplink until their packet arrived at firewall. Maybe we can call it ' join' in the midlle ?

2. does the user retain the same IP when hopping AP?
-- yes, the user retain the same IP when hopping AP

3. i am collecting the packet diag but Should the x.x.x.x filled with my AP ip subnet ? for example 192.168.24.0 ?

Thank you 

Fariq