A user on 802.1x-protected wireless reports slow or stalled ssh connections

Question

We have recently setup 802.1x wireless at our London location. A user is reporting that an ssh copy between the wireless subnet and our server subnet results in consistently-slowing and eventually stalled transfers. The same transfer across two wired segments (utilizing the same gateway -- an ASA) is speedy.

Below is the config from the unit. I have seen this problem before in Cisco environments but I've never been on the team in charge of fixing the issue before, so I have no idea what might be causing it.

Can anyone share some ideas on how to fix this?

ROM Version

LON-AP01# sh ver
Cisco IOS Software, C3600 Software (AP3G2-K9W7-M), Version 15.2(2)JB, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Tue 11-Dec-12 00:15 by prod_rel_team

ROM: Bootstrap program is C3600 boot loader
BOOTLDR: C3600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(25e)JA1, RELEASE SOFTWARE (fc1)

LON-AP01 uptime is 1 day, 22 hours, 53 minutes
System returned to ROM by power-on
System image file is "flash:/ap3g2-k9w7-mx.152-2.JB/ap3g2-k9w7-xx.152-2.JB"
Last reload reason:

Device Model

LON-AP01#sh inv
NAME: "AP2600", DESCR: "Cisco Aironet 2600 Series (IEEE 802.11n) Access Point"
PID: AIR-SAP2602E-E-K9 , VID: V01, SN: REDACTED

Running Config

LON-AP01#sh run
Building configuration...

Current configuration : 4168 bytes
!
! Last configuration change at 00:01:07 UTC Mon Mar 1 1993
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname LON-AP01
!
!
logging rate-limit console 9
enable secret 5 redacted
!
aaa new-model
!
!
aaa group server radius rad_mac
!
aaa group server radius rad_acct
!
aaa group server radius rad_admin
!
aaa group server tacacs+ tac_admin
!
aaa group server radius rad_pmip
!
aaa group server radius rad_eap
 server 10.99.2.11
 server 10.99.2.12
!
aaa group server radius dummy
 server 10.99.2.11
 server 10.99.2.12
!
aaa authentication login eap_methods group rad_eap
aaa authentication login mac_methods local
aaa authentication dot1x default group radius
aaa authorization exec default local
aaa authorization network default group radius
aaa accounting network acct_methods start-stop group rad_acct
!
!
!
!
!
aaa session-id common
no ip routing
no ip cef
ip domain name ds.stackexchange.com
ip name-server 10.99.2.11
ip name-server 10.99.2.12
!
!
!
dot11 syslog
dot11 vlan-name LON-CLIENTS vlan 20
dot11 vlan-name LON-MGMT vlan 10
dot11 vlan-name LON-WIRELESS vlan 50
!
dot11 ssid InformationHighwayOnRamp
   vlan 50
   authentication open eap eap_methods
   authentication shared eap eap_methods
   authentication key-management wpa
   mbssid guest-mode
!
!
dot11 network-map
eap profile stack-eap
 method fast
!
crypto pki token default removal timeout 0
!
!
dot1x system-auth-control
username admin privilege 15 secret 5 redacted
!
!
bridge irb
!
!
!
interface Dot11Radio0
 no ip address
 no ip route-cache
 !
 encryption mode ciphers aes-ccm tkip
 !
 encryption vlan 50 mode ciphers aes-ccm tkip
 !
 ssid InformationHighwayOnRamp
 !
 antenna gain 0
 stbc
 mbssid
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio0.50
 encapsulation dot1Q 50
 no ip route-cache
 bridge-group 50
 bridge-group 50 subscriber-loop-control
 bridge-group 50 spanning-disabled
 bridge-group 50 block-unknown-source
 no bridge-group 50 source-learning
 no bridge-group 50 unicast-flooding
!
interface Dot11Radio1
 no ip address
 no ip route-cache
 !
 encryption vlan 50 mode ciphers aes-ccm tkip
 !
 encryption mode ciphers aes-ccm tkip
 !
 ssid InformationHighwayOnRamp
 !
 antenna gain 0
 no dfs band block
 stbc
 mbssid
 channel dfs
 station-role root
 bridge-group 1
 bridge-group 1 subscriber-loop-control
 bridge-group 1 spanning-disabled
 bridge-group 1 block-unknown-source
 no bridge-group 1 source-learning
 no bridge-group 1 unicast-flooding
!
interface Dot11Radio1.50
 encapsulation dot1Q 50
 no ip route-cache
 bridge-group 50
 bridge-group 50 subscriber-loop-control
 bridge-group 50 spanning-disabled
 bridge-group 50 block-unknown-source
 no bridge-group 50 source-learning
 no bridge-group 50 unicast-flooding
!
interface GigabitEthernet0
 no ip address
 no ip route-cache
 duplex auto
 speed auto
 bridge-group 1
 bridge-group 1 spanning-disabled
 no bridge-group 1 source-learning
!
interface GigabitEthernet0.50
 encapsulation dot1Q 50
 no ip route-cache
 bridge-group 50
 bridge-group 50 spanning-disabled
 no bridge-group 50 source-learning
!
interface BVI1
 ip address 10.99.0.6 255.255.255.0
 no ip route-cache
!
ip default-gateway 10.99.0.1
ip forward-protocol nd
ip http server
no ip http secure-server
ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag
ip radius source-interface BVI1
!
radius-server attribute 32 include-in-access-req format %h
radius-server host 10.99.2.11 key 7 redacted
radius-server host 10.99.2.12 key 7 redacted
radius-server vsa send accounting
!
bridge 1 route ip
!
!
!
line con 0
line vty 0 4
 transport input ssh
!
end

LON-AP01#

Answer 1

Been awhile since I worked Cisco APs on the command line however if I am reading the configuration right, there are a couple of changes I would make that may help performance.

As it stands, if any client does connect using TKIP, then the AP will automatically disable the MCS rates (i.e. 802.11n rates), leaving you with only legacy rates (up to 54Mbps). This can have a serious performance impact as it affects all clients.

First, in your configuration, I would set the wireless to specifically use WPA2. While not necessary for performance once you disable TKIP (with TKIP enabled, some clients that choose to use WPA rather than WPA2 will also use TKIP by default) this does simplify troubleshooting as you don't have to figure out which key management method is in use by clients. You can do this by changing to this:

dot11 ssid InformationHighwayOnRamp
 authentication key-management wpa version 2

Second, you have TKIP enabled as an option in your configuration and again, if any one client connects to the wireless using TKIP, then the AP will disabled all 802.11n MCS data rates. I would only allow AES-CCMP by changing these lines (appears multiple times in the config):

encryption vlan 50 mode ciphers aes-ccm tkip
encryption mode ciphers aes-ccm tkip

to this:

encryption vlan 50 mode ciphers aes-ccm
encryption mode ciphers aes-ccm

Keep in mind your question is still very broad and this is only a starting point. If we get further information, I can edit my answer later.

Answer 2

Firstly, performance on a wired connection will usually ALWAYS be better than a wireless connection. A wireless network is using a shared medium (air) to transfer data. Wireless communication has always been and is still half duplex. As much as MIMO allows multiple data channels to be formed, only one device can still occupy the given channel-space at a time.

Anyways, back to your issue. You're using a 2602 which contains a 3x4 MIMO. Its configured in autonomous mode. I'm going to assume you have a few APs configured with the exact same SSID/password in order to extend the coverage area or device density.

You should check a few things....

• Do a concurrent ping to or from the computer while you reproduce the issues.
• Find out what frequency you're connected on. (2.4 or 5 Ghz)
• Find out if the device is doing a layer-2 roam by issuing a term mon (to watch it in realtime) or show logg to check the history.
• Ensure you have the proper IAPP config on the APs by issuing wlccp wds priority <value> interface BVI1 You can see more information about WLCCP here

It sounds to me that the 802.1x credentials are taking too long to process and re-authenticate to the roamed AP. This would stop the data flow and have packets destined to the wrong AP until the credentials are processed. Once the credentials are processed, the new ARP entry is sent out via AP and the switch then learns where to send the data for that MAC/IP.

If you're hoping to get better roaming results. I strongly recommend buying a controller. Perhaps you decided to forgo that cost since it can be expensive, especially if you only have 2 or 3 APs in the area. But a WLC 2504 is fairly cheap it offers similar features to the larger 5508s and etc. Some features include centralized management, RRM, Cisco Clean Air (whether you believe this really helps or not), and Layer 2 or Layer 3 roaming capabilities. The newer 7.4 code also includes 802.11r and 802.11k extensions for faster and more controlled device-AP roaming.