Intermittent site issue - AWS

[Tauriq]

Hi Team, 

I am currently experiencing a weird one , we have our internal sites hosted in AWS with some servers being hosted there on VPN.

During the day we have intermittent drops to the site we trying to access but only on certain access points in the building and a reboot of the access points fixes the issue, please note when on cable I have no issues whatsoever.

I looked at the logs and found WPAD errors for the users but not really sure if this might be the issue as I am entry level when it comes to looking at those logs.

We have policies enable and tested without any security profiles and the issue persist with the same security profile enabled on the LAN connection.

I have looked at DNS and added manual DNS to the user machines and the issue persist.

Please note this is only an issue on certain access points at certain times during the day.

[srajapratap]

Hello Tauriq,

If you are facing client connectivity issues over the wireless, then you may check for the below reasons that could cause this.

1. If the client is unable to connect to FortiAP:
   Make sure the client security and authentication settings match with FortiAP and also check the certificates.
   Try upgrading the Wi-Fi adapter driver, FortiGate and FortiAP firmware.
   If other clients can connect, the issue can be with device interoperability. Run debug commands and sniffer packets.
   Look for rogue suppression by sniffing the wireless traffic and looking for the connection issue in the output (using the AP or wireless packet sniffer).
   Try changing the IEEE protocol from 802.11n to 802.11bg or 802.11a only.
2. If the client drops and reconnects:
   The client might be de-authenticating periodically. Check the sleep mode on the client.
   The issue could be related to power-saver settings. The client may need to update the drivers.
   The issue could also be caused by flapping between APs. Check the roaming sensitivity settings on the client or the preferred wireless network settings on the client. If another WiFi network is available, the client may connect to it if it is a preferred network. Also, check the DHCP configuration as this configuration may be an IP conflict.
3. If the client drops and never connects:
   The client could have roamed to another SSID. Check the standby and sleep modes.
   You may need to bring the interface up and down.
4. If the client connects, but no IP address is acquired by the client:
   Check the DHCP configuration and the network.
   There could be a broadcast issue. Check the WEP encryption key and set a static IP address and VLANs.

Also, you can collect the below debugs when the issue happens, this will assist in analyzing what's happening with the 4-way handshake.

# diagnose wireless-controller wlac sta_filter <client MAC address> 2

Alternatively, if the issue is on the FortiGate end for some reason, you can check if cw_acd process is crashing or not using the below:

# dia deb crash read

This is referenced in the 'Client connection issues' section of the below document. 

https://docs.fortinet.com/document/fortiap/6.2.0/fortiwifi-and-fortiap-configuration-guide/692236/tr...

For further analysis, call the support and a TAC engineer will further assist you by analyzing the logs collected.

Regards

[hbac]

Hi @Tauriq,

It seems like you are having issues only on wireless network. What is the firmware version of the FortiGate and FortiAP? When did the issue start and what was changed? Can you share the error logs? 

Regards, 

[Tauriq]

@hbac 

@srajapratap 

We have determined that its not a network issue as anything else is accessible just our connection to the specific site, the unfortunate part is the issue occurs at very erratic times , its no fixed times at all and it happens to all the users connected to that specific access point.

I will run a packet capture if we experience the issue again , please be advise that this also only happens when connected to VPN which is a requirement to access our internal site.

[srajapratap]

Hello @Tauriq ,

If the issue is site-specific, and everything else works fine while being connected to specific APs, then it's best to take wireshark capture on the user device, ingress interface, and egress interface of the FortiGate. Then, look for any TCP retransmissions, resets, or others, and then correlate them with the captures of a working setup, i.e., the website that works in this topology.

Regards