Media for WDS + WPA + RADIUS problem

WDS + WPA + RADIUS problem

In the interest of unified learning it was suggested I post to this newsgroup, rather than direct email communication.

One of our clients is an accommodation complex. They want to provide internet access to all their tenants and unfortunately due to the layout of the buildings it was not cost effective to run wired cables. As a result we went for a wireless solution.

There are 4 groups of buildings in total. The administration building and 3 complexes with units in them. They are spread out over a reasonable amount of distance. Each complex has two physical buildings. The buildings are all brick and are two storey.

We ended up going with 4x Netgear WG302v2's, using 21db waveguide's and 1watt amplifiers. This was at the recommendation of a colleague of ours. The units were setup in peer to multi-peer configuration with the AP at the administration building being the main AP, where a server running freeRADIUS and an internet connection exists.

The APs were configured with WDS, having three SSIDs and VLANs. A silent SSID for the management vlan, an open security SSID for the guest VLAN which has a single website that provides the users with the information on configuring their computers and a WPA2 Enterprise secured SSID for the internet VLAN.

Users authenticate using WPA2/802.11x authentication against the RADIUS server using a username and password.

Aside from the complications imposed in configuring Windows based computers with dot1x, we got the system up and running, however we started experiencing randomly timed packet loss. We attempted adjusting the radio power levels in a hope to eradicate this problem (thinking it was radio overlap) but to no avail.

When the packet loss occurs, the APs drop out and have to re- authenticate against the primary access point, which in turn causes connection to the RADIUS server to fail and boots all users off.

We have since gone back and attempted to configure the system in purely repeater mode, but this resulted in more users being unable to stay connected for an extended period of time. We have tried taking out the AP of the building in the middle, so there are only 3 radios in total, this helped a little, except that a section of the complex does not get a strong enough signal to connect now.

We have setup monitoring to measure latency and packet loss, in an attempt to try and determine any set pattern for the problem, however all we have found is that it is mostly random - occuring any time throughout the day, but much worse in the evening when most tenants are attempting to use the system.

When this problem occurs, the radios event logs report "tx queue stuck" just before they bomb out.

Unfortunately there is no way to hard wire each AP together without an expensive outlay in fibre optics. It has also been suggested (by the colleague who helped us in the first place) that we may need to setup additional APs in the 5ghz spectrum to handle the link between the admin building and each complex, and run each of the existing radio's on a separate channel and SSID, to avoid overlap.

Although this would most likely work - it seems like a massive over complication and defeats the purpose of WDS to begin with.

We've struggled to find any really good information on this type of setup so any help would be greatly appreciated. The client is extremely frustrated as their tenants are not getting a fast, reliable connection and we need to find a solution for them soon.