Issues with 802.1x Login Window Profile and reconnections

[MattT]

Hi there,

We are having a pretty shoddy experience with our 802.1x profile on our Macs, both Mavericks and Yosemite. Our setup:
AD accounts, RADIUS authentication. Extreme Networks gear.
10.9.4 and above (symptoms vary slightly from Mavericks to Yosemite)
Profile for Built-in-Wireless port, WPA2 Enterprise, Enterprise Mode: Loginwindow/System
PEAP, Autojoin, no proxy set
Trusted certificate included

We have a very inconsistent first log in success rate but even once past this we see very intermittent reconnection of wifi after laptop sleep. Close it for 10 seconds, bring it back up and the wifi sits as ticked but won't reconnect until manually done so in Network Preferences. Roaming also seems to be an issue with the profile, causing the same symptoms as we get from sleep.

We have investigated RADIUS logs and found nothing. However, I removed the profile from an affected machine yesterday and have had a flawless experience since.

Any ideas on this one? We are looking to upgrade our 10.9 fleet to 10.10 but are hesitant to do so until we can rectify this problem.

[jhbush]

@mtaylor934 are you setting this profile up using the JAMF built in profile generator or crafting your own? I've always had better success making my own than using the JSS for login window profiles. YMMV as things have been updated since I built those on a regular basis.

[MattT]

@jhbush1973 We use the the JAMF creator but I will create a replica profile locally and give this a go.

[MattT]

@jhbush1973 I created a replica profile (at least I think it is, the settings are a tad different compared to JSS 9.32) with Profile Manager. It installs at User level by default, where as JSS does so at System level; I am unsure if this will have any effect as the profile still shows at login screen.

I have done some testing, and while I do have to manually connect at login after restart, the automatic reconnect after sleep/wake is now running smoothly. When logging in after restart, I am seeing the same behaviour with the WiFi SSID being ticked but no authentication taking place

[plawrence]

@mtaylor934

We are seeing the same issues with Login Window wifi profiles in Yosemite. The same profile works fine in 10.9. It seems as though this could be a bug with 10.10, there has been a discussion about it on MacEnterprise (https://groups.google.com/forum/#!searchin/macenterprise/wifi/macenterprise/gQ4DtEpAN5c/qoR6WSMtHBsJ)

The issue has been around since 10.10.0 and still appears to be there in the latest 10.10.3 beta, but you might want to test it out yourself.

[CGundersen]

We continue to experience 802.1x/Login Window issues with every version of Yosemite I've tested. 10.9.5 is pretty solid (for us). If you can, open a case with Apple and let them know how many machines are affected and that it is (part of) the reason for a delayed rollout.

[ooshnoo]

I've had a ticket open with Apple regarding this exact behavior for many months now.

The response I got recently was that product engineering has identified an auto join issue which they believe to be responsible for the behavior you’re seeing, and they want us to try OS 10.10.3 beta 3. Haven't done it yet. Maybe today.

[bentoms]

10.7+ has worked fine for us, but we needed amend some settings in the profile for 10.10 & with 10.8 we needed to make an amendment to the Network Policy Server.

Haven't tested 10.10.3.

[MattT]

I will give 10.10.3 a go as soon as possible, thanks @ooshnoo. @bentoms were the settings you changed specific to your network set up or might they be relevant more widely? Anything I can get my hands on at this point is a plus.

[jagress]

@bentoms I'm curious what changes you had to make to the Network Policy Server for 10.8?

[plawrence]

I've just tried the recently released 10.10.3 beta (build 14D113c) and I am still seeing the same issue. Has anyone else had any luck with the betas or otherwise?

[Kumarasinghe]

We use Login Window and System configuration profile on our Macs and seeing the Wi-Fi reconnection issue after waking from Sleep (close the lid and open it after 15 mins) with OS X 10.10.x.
After waking from sleep it tries to connect to our Wi-Fi endlessly.

Created a Bug report yesterday and already submitted some followup diagnostic reports.

[bentoms]

@jagress I posted it. :)

[jagress]

@bentoms Are you using Server 2008 or 2012 for NPS?

Also, is anyone using machine authentication via RADIUS (instead of user authentication). Both always worked for us on Server 2003 IAS, but can't seem to get the machine auth to work on Server 2012 NPS.

Thoughts? Thanks!

[bentoms]

@jagress Win 2k8 r2.

[jasric1989]

Hi we are getting this problem with Sierra and El Capitan. Has anyone managed to find the cause or reason for this?