Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 14 replies
  • Subscribers 29 subscribers
  • Views 21307 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Sophos XG: Fast transition / WiFi roaming does not work

MarkusSchlüter1

Hi,

right now I do have an AP15 and AP55 at home.

 

Setup: In the upper floor I installed the AP55 and downstairs the AP15.

 

I make use of 7 different SSIDs and only two of them are also broadcasted by the AP 15 (yes, I enabled "Fast Transition" in both SSIDs), but the roaming does not work at all.

Whenever I go up- or downstairs I do have to disable / enable WiFi on my smartphone (Google Pixel XL), tablet (iPad Pro 2017) and notebook (MacBook 12 2017)

to switch the access points :-/

 

The firmware version of my Sophos XG Home Edition is SFOS 17.1.1 MR1.

 

Anyone out there knowing a solution to this hell of a problem?

 

Thanks in advance,

 

Markus



This thread was automatically locked due to age.
Parents
  • 0

    Probably means the devices can see a strong enough signal to not change APs. Try reducing your AP output level and see what affect that has?

    Ian

  • 0 in reply to rfcat_vk

    Roaming is a device task. So i would advice the same. If the radius of both APs cross to much, the client can get "confused". 

  • 0 in reply to LuCar Toni

    I find the same issue with my environment - I have 6 sites quite apart that share the same SSID and I also find myself disabling / re-enabling my wifi to get it going.

    They are not connected to the old AP as its well out of range.

    I find that if I have a FW rule to allow everything out it works fine - so clearly an authentication thing with XG

  • 0 in reply to M8ey

    Hi Ian,

    I don't understand how a firewall rule affects internal AP roaming?

     

    Ian

  • 0 in reply to rfcat_vk

    Not so much Roaming but Authentication in my case.

  • 0 in reply to M8ey

    Hi Ian,

    I am still having trouble with this firewall rule. Are you saying you have rule between each of your APs and the assume MS (authentication) server?

    Please explain in detail your AP connections to the XG.

    Thank you

    Ian

  • 0 in reply to rfcat_vk

    Sure 

    The WLAN users authenticate via RADIUS SSO to the XG

    So if the XG fails to Authenticate them they pass no traffic. The default Firewall rule blocks unauthenticated traffic in my case.

  • 0 in reply to M8ey

    Hi Ian,

    I was contemplating trying Radius at home but decided against it because the MS server was requiring to many userid to be created and then there is how much pain is worth the experiment from the 'my internet is not working fixit brigade'?

    I can setup a number of Sophos APs but not SSO authentication.

    Ian

  • 0 in reply to rfcat_vk

    Believe me the RADOIS SSO is a real PITA if it doesn't work with devices dropping and the continuous turn wifi off / turn wifi on to re-authenticate

    For a Home install I would just reserve IPs for devices and use Clientless Users. Also no IT Support needed RIGHT now as the dogs wifi stopped during Dogtube

     

    Much less hassle and no need to worry about sharing the password to family.

     

    Here we have around 250 Users and 150 Wireless Devices and trust no one with a password LOL

  • 0 in reply to M8ey
    My home network is quite complex, but will be simplified when the "NB" arrives. When I worked full time at IT stuff we used AD assigned groups to allow wifi access, though that does have holes which allows users with byod to logon to the wifi but not access any resources. Ian
  • 0 in reply to rfcat_vk

    I still apply Web policies and App policies by user so need RADIUS to identify them.

    I also like the ability to audit who did what when etc where as a group is much harder.

     

    I do put some iPads into a group as these are locked down and I know the plebs cant abuse it

  • 0 in reply to M8ey

    I am still struggeling with the issue here.

    You are using the Radius SSO Option or Radius accounting option with sophos branded APs? 

    As far as i know, the radius mapping should not be involved into the roaming scenario because your Client IP never change after you roam to another AP, isnt it? 

    Which AP Solution do you use? 

Reply
  • 0 in reply to M8ey

    I am still struggeling with the issue here.

    You are using the Radius SSO Option or Radius accounting option with sophos branded APs? 

    As far as i know, the radius mapping should not be involved into the roaming scenario because your Client IP never change after you roam to another AP, isnt it? 

    Which AP Solution do you use? 

Children
  • 0 in reply to LuCar Toni

    Sorry for the confusion.

     

    Not using Sophos AP's - Meraki MR range

  • 0 in reply to M8ey

    Ok! 

    Lets go the next steps together. 

    You have APs (nvm which one) and a Radius Server. 

    I "assume" you have split the broadcast domains into different subnet ranges? 

     

    So basically you have something like: VLAN(Management) - XG - VLAN(Server). 

    In VLAN(Management) there are all APs connected to.

    And in VLAN(Server) there is the Radius Server? 

     

    So basically the AP send the Radius Request through XG to the Radius server.

     

    Next step is, you are using the Radius requests as SSO on XG. So the Accounting information from radius get send to XG and XG can do the mapping from IP(Client) to Username.

     

    Am i right? 

    Because at this point, i am not able to see, whether the XG causes the issue because of lack of feature or just because some firewall rule is missing in the communication between the connected components.