Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Locked thread
Erwin
Feb 17, 2006

My Rhythmic Crotch posted:

The only thing I don't get is... why no Linux version of the controller?
There is, it works great. You just have to add their repo and use apt. This of course assumes you're okay using Ubuntu or Debian.

See here: http://forum.ubnt.com/showthread.php?t=45945

...or see the thread about the beta version, if you have AP-Pros.

Erwin fucked around with this message at 19:32 on Jul 31, 2012

Adbot
ADBOT LOVES YOU

Nebulis01
Dec 30, 2003
Technical Support Ninny

Dick Trauma posted:

Indeed. But The Man will be paying for it, just like he paid for my excellent lunchtime hickory burger. :coal:

I just finished a demo of Meraki vs Aerohive and we opted to go with the Meraki hardware. PO for 9 new APs and and a PoE switch goes out tomorrow :toot:

adorai
Nov 2, 2002

10/27/04 Never forget
Grimey Drawer

My Rhythmic Crotch posted:

The only thing I don't get is... why no Linux version of the controller?
The controller is java, it runs on linux, and in fact they have packages for debian/ubuntu (hint: read the release notes).

My Rhythmic Crotch
Jan 13, 2011

adorai posted:

The controller is java, it runs on linux, and in fact they have packages for debian/ubuntu (hint: read the release notes).

(hint: they need to put it on the download page)

Fly
Nov 3, 2002

moral compass
This thread is excellent. I am about to install a small business-class network with a private network plus guest access using two or three access points.

It should save a lot versus a Meru-based system from what I can see.

edit: I've been testing the UniFi AP Pro units for a day now, and I can say that I am now a big fan of Ubiquiti. I did have to install the beta drivers in Linux, and that works great. The configuration server works beautifully on OS X, too.

I want to try mucking with VLAN settings next.

Fly fucked around with this message at 02:01 on Aug 4, 2012

other people
Jun 27, 2004
Associate Christ
I installed two UniFi APs in a residential home this past week and it was a breeze (other than laying the cable... ha). They are awesome, simple, and just work. I want to cover my house in them.

Rescue Toaster
Mar 13, 2003
So I'm assuming that RADIUS/PEAP should be considered broken due to the MS-CHAPv2 break?

What alternatives are there? EAP-TLS requires client certificates. Is there any replacement for PEAP that common clients (windows/linux machines, android phones/tablets) are likely to support?

Further, my understanding is that the AP doesn't actually care or need to support the particular method of authentication that the RADIUS server is using as long as it supports RADIUS in the first place, right? I'm not sure what options exactly my new Ubiquiti UAP will support.

Mierdaan
Sep 14, 2004

Pillbug

Rescue Toaster posted:

So I'm assuming that RADIUS/PEAP should be considered broken due to the MS-CHAPv2 break?

I hadn't heard of this yet, so here's Moxie Marlinspike's post about how stupidly easy they're making it.

adorai
Nov 2, 2002

10/27/04 Never forget
Grimey Drawer

Mierdaan posted:

I hadn't heard of this yet, so here's Moxie Marlinspike's post about how stupidly easy they're making it.
I hadn't either but thanks to Rescue Toaster, I have now pulled our only RADIUS/PEAP/MSCHAPv2 access point from production. I don't think anyone could have used the attack to access our network wirelessly, but could have potentially gotten some AD passwords out of the deal which could then be used in other attack vectors.

Rescue Toaster
Mar 13, 2003
Here's what I've gleaned so far. Don't take it as official, since I haven't found ANY official statements from any big players on how PEAP/EAP-MSCHAPv2 is affected.

The MSCHAPv2 handshake should be protected by the secure PEAP tunnel in normal operation. However, PEAP's security comes solely from the RADIUS server's certificate. And it's not as simple for a client to verify as it is for a web ssl certificate coming from a certain domain.

A lot of clients can easily be told to ignore the server certificate with a simple checkbox (windows) or might even ignore server certificate validity by default. Or they may trust every certificate signed by anyone in their root store (not too difficult or expensive, obviously). Ideally the user manually chooses to only trust your particular root CA that you use for a given RADIUS system. But leaving this up to the client configs is pretty annoying unless you're on a domain.

If the client ignores the RADIUS certificate's validity or trusts anyone but your own personally controlled root CA for your RADIUS connection, then you're open to a man-in-the-middle as with any certificate-controlled transport layer security. Once they can do that they can observe the MSCAPv2 handshake and recover the client's password with single DES difficulty (ie not difficult).

Without a consistent chain of trust in place RADIUS/PEAP/EAP-MSCHAPv2 is vulnerable to the Main-In-The-Middle. Then it's basically the same as RADIUS/MS-CHAPv2 without PEAP. I guess Single DES is still a lot more work than a WEP key, but a lot less than WPA2-PSK Personal (basically unbreakable except for stupid passwords or the WPS vulnerability),

Rescue Toaster fucked around with this message at 23:03 on Aug 8, 2012

Jadus
Sep 11, 2003

Jadus posted:

What options are there right now for high bandwidth, short distance wireless connectivity?

bort posted:

We use Bridgewave AR60s for a couple of short-rage wireless jumps.

Unfortunately spending $20k per side isn't something I can justify to the higher ups.

I did get approval to try out an 802.11ac access point since they were relatively low cost, so I bought a couple Netgear R6300s, pointed them across the parking lot (through glass) and am currently getting about 70 Mbps actual transfer rate (through robocopy from one PC to another) which is less than I expected.

Unfortunately there's some type of bug with the units where it randomly won't recognize traffic from some PC's, so I'm back to the drawing board.

I'd love to try an Ubiquiti AirFiber, but it doesn't look like they ship to Canada yet.

ptier
Jul 2, 2007

Back off man, I'm a scientist.
Pillbug

Jadus posted:

Unfortunately spending $20k per side isn't something I can justify to the higher ups.

I did get approval to try out an 802.11ac access point since they were relatively low cost, so I bought a couple Netgear R6300s, pointed them across the parking lot (through glass) and am currently getting about 70 Mbps actual transfer rate (through robocopy from one PC to another) which is less than I expected.

Unfortunately there's some type of bug with the units where it randomly won't recognize traffic from some PC's, so I'm back to the drawing board.

I'd love to try an Ubiquiti AirFiber, but it doesn't look like they ship to Canada yet.

We are currently doing something like that with some buffalo products across a busy street and getting full cable speeds out of it. But yea. Not for internal network. :(

Galler
Jan 28, 2008


Rescue Toaster posted:

Here's what I've gleaned so far. Don't take it as official, since I haven't found ANY official statements from any big players on how PEAP/EAP-MSCHAPv2 is affected.

The MSCHAPv2 handshake should be protected by the secure PEAP tunnel in normal operation. However, PEAP's security comes solely from the RADIUS server's certificate. And it's not as simple for a client to verify as it is for a web ssl certificate coming from a certain domain.

A lot of clients can easily be told to ignore the server certificate with a simple checkbox (windows)

This is exactly how our wifi at work is setup. 300+ laptops using PEAP & MSCHAPv2 and setup to ignore the certificate. I should probably tell someone about this but then I would probably have to go around to every laptop in the facility and gently caress with the wireless settings because the people above me are afraid of group policy. Eh, not my responsibility and this company is hosed anyway.

KillHour
Oct 28, 2007


Jadus posted:

Unfortunately spending $20k per side isn't something I can justify to the higher ups.

I did get approval to try out an 802.11ac access point since they were relatively low cost, so I bought a couple Netgear R6300s, pointed them across the parking lot (through glass) and am currently getting about 70 Mbps actual transfer rate (through robocopy from one PC to another) which is less than I expected.

Unfortunately there's some type of bug with the units where it randomly won't recognize traffic from some PC's, so I'm back to the drawing board.

I'd love to try an Ubiquiti AirFiber, but it doesn't look like they ship to Canada yet.

I've had good feedback with these:

http://engeniustech.com/business-networking/outdoor-access-points-client-bridges/16343-enh210-new

If your budget is a bit higher, you might want to try fluidmesh:

http://www.fluidmesh.com/en/products/fluidmesh-mito.html

They're tested to full throughput (limited to 100mbps by the copper interface) at 5 miles.

Edit:

http://www.dragonwaveinc.com/products/packet-microwave/horizon-quantum :v:

KillHour fucked around with this message at 20:27 on Aug 19, 2012

Nitr0
Aug 17, 2005

IT'S FREE REAL ESTATE

Jadus posted:

Unfortunately spending $20k per side isn't something I can justify to the higher ups.

I did get approval to try out an 802.11ac access point since they were relatively low cost, so I bought a couple Netgear R6300s, pointed them across the parking lot (through glass) and am currently getting about 70 Mbps actual transfer rate (through robocopy from one PC to another) which is less than I expected.

Unfortunately there's some type of bug with the units where it randomly won't recognize traffic from some PC's, so I'm back to the drawing board.

I'd love to try an Ubiquiti AirFiber, but it doesn't look like they ship to Canada yet.

How much bandwidth do you need and what distance are you talking about? Is it LOS?

The typical range depending on pricing.

Low price, good results: http://www.ubnt.com/airmax#rocketm
High price, Great results: http://www.cambiumnetworks.com/products/index.php?id=ptp500

Jadus
Sep 11, 2003

Nitr0 posted:

How much bandwidth do you need and what distance are you talking about? Is it LOS?

The typical range depending on pricing.

Low price, good results: http://www.ubnt.com/airmax#rocketm
High price, Great results: http://www.cambiumnetworks.com/products/index.php?id=ptp500

The link is going to be used for running backups from our head office to a disk array in an adjacent building as semi-offsite backups. So ideally as fast as possible.

Right now we're getting about 20 Mbps actual transfer speed with the Engenius 5611p, which has been rock solid, but that speed just isn't going to cut it for the backup size we have.

I was hoping I'd be able to get decent speeds out of the 802.11ac devices for this purpose; my first test with my new link ran at 144Mbps which was fantastic, but I haven't been able to get those kinds of speeds again since.

Its across a parking lot of about 250 feet, and I have clear line of sight through glass windows (no roof access at the moment).
http://goo.gl/maps/kVupq
If we were the two buildings just to the west, I'd just get some fiber strung over the air between the two.


KillHour posted:

I've had good feedback with these:
http://engeniustech.com/business-networking/outdoor-access-points-client-bridges/16343-enh210-new
If your budget is a bit higher, you might want to try fluidmesh:
http://www.fluidmesh.com/en/products/fluidmesh-mito.html
They're tested to full throughput (limited to 100mbps by the copper interface) at 5 miles.

I am thinking about trying the Engenius ENH500, since the 2.4GHz band is very congested in my area, but our Engenius 5611p has been super stable for multiple years now.

KillHour
Oct 28, 2007


Jadus posted:

The link is going to be used for running backups from our head office to a disk array in an adjacent building as semi-offsite backups. So ideally as fast as possible.

Right now we're getting about 20 Mbps actual transfer speed with the Engenius 5611p, which has been rock solid, but that speed just isn't going to cut it for the backup size we have.

I was hoping I'd be able to get decent speeds out of the 802.11ac devices for this purpose; my first test with my new link ran at 144Mbps which was fantastic, but I haven't been able to get those kinds of speeds again since.

Its across a parking lot of about 250 feet, and I have clear line of sight through glass windows (no roof access at the moment).
http://goo.gl/maps/kVupq
If we were the two buildings just to the west, I'd just get some fiber strung over the air between the two.


I am thinking about trying the Engenius ENH500, since the 2.4GHz band is very congested in my area, but our Engenius 5611p has been super stable for multiple years now.

The only problem with the ENH500 is that the copper port is limited to 10/100. If you need more than that, I've heard rumors of an ENH510 that should have a 10/100/1000 port.

bort
Mar 13, 2003

Has anyone had an issue with IOS/iPhone connectivity to Cisco WLC infrastructure with web auth? Clients work fine to my WPA2/802.1x SSIDs but get denied immediately going to my guest network (open w/web auth). e: They don't get DHCP addresses or appear on client debugs.

Running 6.0.202.0.

edit: solved, enable Fast SSID Change on the controllers.

bort fucked around with this message at 17:00 on Aug 29, 2012

Rescue Toaster
Mar 13, 2003
Man I got bit for the longest time by Intel's default settings for the Ultimate-N 6300 adapter. You have to manually go into the device manager and adjust the settings to set channel bonding @ 2.4Ghz to 'Auto' instead of '20Mhz only'. Yes, bonding on 2.4Ghz is often difficult to deal with because of limited channels, but why on earth is that a client setting?

If I know there's no interference, and enable all my AP's to use bonding, why would clients just arbitrarily ignore it? Stupid. Had like 20 new laptops with Ultimate-N's and I had to go one by one and manually set the device manager setting.

jbusbysack
Sep 6, 2002
i heart syd

Rescue Toaster posted:

Man I got bit for the longest time by Intel's default settings for the Ultimate-N 6300 adapter. You have to manually go into the device manager and adjust the settings to set channel bonding @ 2.4Ghz to 'Auto' instead of '20Mhz only'. Yes, bonding on 2.4Ghz is often difficult to deal with because of limited channels, but why on earth is that a client setting?

If I know there's no interference, and enable all my AP's to use bonding, why would clients just arbitrarily ignore it? Stupid. Had like 20 new laptops with Ultimate-N's and I had to go one by one and manually set the device manager setting.

Because each set of bonded channels takes up approx 60% of the 2.4 (US) spectrum and you still overlap with a neighboring AP doing the same thing assuming this is a multi-ap deploy.

If only 1 AP then go hog wild I guess?

CuddleChunks
Sep 18, 2004

Jadus posted:

I'd love to try an Ubiquiti AirFiber, but it doesn't look like they ship to Canada yet.

Look at all the n00bs with their wussy little megabit over the air links. Cya shitlords later, I'm moving to all the gigabits! http://www.ubnt.com/airfiber

This magical beam of blue packets full of internets will increase crop yields, maximize your latencies, fill all your packets with all the internets and also uses magical radio antenna design that took 100's of years of R&D to develop.

loving Edison was all like, "some day, this poo poo will blow your asses out of your socks!" and we're all like Hellz yeah here comes the PAIN my friends!

Fuckin' GPS right up in this bitch so your dipshit installer can show up drunk (as usual) and still not gently caress it up. In fact, our mounting process is so easy, it's as if the drat thing aligns itself! Warning: if the unit aligns itself then Total Autonomy mode may have activated. Do not approach a radio in this state - report to your nearest service center immediately.

=======================================================

Okay, I'm just jazzed up by the ridiculous marketing materials for this radio. Also because I overheard one of our admins talking about getting a pair of these to put in a humongous link for one of our clients. If we end up getting them, I'll let you know how it goes. It'll probably be like most of our Dragonwave links - unless power is off you don't know they're there because of how well they work.

Fly
Nov 3, 2002

moral compass
Just an update on Ubiquiti installations I installed two AP Pros at church, and that's working great though we don't have a lot of people connecting to it.

I recommended Unifi for a move into new office space at work, and we have two of the regular APs running now. We'll see how well they handle a small load of about a dozen users beginning this next week. Coverage from the regular APs blows away that of consumer wireless routers.

ptier
Jul 2, 2007

Back off man, I'm a scientist.
Pillbug

Fly posted:

Just an update on Ubiquiti installations I installed two AP Pros at church, and that's working great though we don't have a lot of people connecting to it.

I recommended Unifi for a move into new office space at work, and we have two of the regular APs running now. We'll see how well they handle a small load of about a dozen users beginning this next week. Coverage from the regular APs blows away that of consumer wireless routers.

Just a fun tidbit: We had a client (Church) host a conference and we installed UniFi's (not pro or LR, just regular) all over the building and at one time we had 120 users connected to one AP. They were all connected and working great. The only issue was that we were running SBS 2011 and DHCP would only handle 254 IPs. Once we churned the DHCP a little bit and dropped some dead weight they all had a good time. We felt so sorry for that little guy.

nulldev1ce
Aug 16, 2002
Shiny Globule
We deployed 32 Aruba 105s and a 3400 controller in a high school last year, and expanded 20 more 105's to the middle school this year. It has been the most set-it-and-forget-it system I've ever dealt with. The reseller we used has an Aruba expert who spent the day with us getting it set up; without his help, I would've slit my own throat. I find the admin interface pretty intimidating. But, boy, once it's going, it Just Works.

When I started five years ago, the school's wireless ran on Airport Extremes (the saucer kind, B/G only) and no security whatsoever. Then we got BlueSocket (before they were acquired by AdTran), but our budget was so tight, we did it pretty half-assed and it was a disaster. We used their free VMWare-based controller, and bought about half the APs we actually needed because we didn't have a heatmap done. Then we skimped on their support contract and tried to set it up ourselves with a bit of help from a sympathetic engineer. 802.1X was a nightmare, we had to fall back to WPA2 Personal and enter the password on every school laptop by hand, in the middle of the year. On top of everything else, it turned out that their firmware was botched (the engineer admitted "this is our fault, not yours") and when I started to make more noise about it to sales, they got pissy about our not having bought the support plan. This is all within the first year of ownership. It got ugly and I ended up selling the gear on eBay later.

Back to Aruba: We have a somewhat-unique scenario in that we're almost 100 percent OS X/iOS, using Mac servers with OD and Apple's implementation of FreeRADIUS. (Yeah, it's an exercise in pain.) We also have a very liberal BYOD "policy" -- students can bring anything to school, they are not required to register their devices with us in any way, and we have no content filter on our network. We're near a big-shot university, so lots of the families have money and almost all the students have at least a smartphone, usually a laptop or iPad as well. It's a public school, but it runs a lot like a private school, or tries to. Lot of entitlement complexes.

Anyway, we run with three SSIDs:
- One for guests, which does all the NAT/DHCP on the controller itself and cannot touch our internal stuff (SIS, fileservers, printers) -- it's *just* Internet access.

- Then there's a "trusted" network, bridged to an internal VLAN (our servers do the DHCP/DNS etc.) and with WPA2 Personal passphrase set on every school laptop, requiring administrator privileges to reveal. We don't want the trusted clients to be double-NAT'd since we use ARD (Apple's VNC with a twist) to update clients and to spy on the little darlings occasionally.

- The third network is for BYOD and uses 802.1X so the students log in as themselves and are therefore identifiable. (There is actually a fourth SSID, hidden, which is for devices that just can't cope with the 802.1X stuff -- it uses a WPA PSK and then a web captive portal to authenticate the kids. A few Windows clients have to fall back to that, but Macs and iThings seem to be coping really well with RADIUS.) The BYOD network is NAT'd on the controller like the guest network, but has some firewall exceptions to allow the students to access internal resources in limited ways (e.g. they can use the PaperCut web interface to print, but they can't do LPD/IPP directly to the printers; they can use the Rumpus web interface to get at their files on the Mac server, but they can't hammer away directly at AFP; etc.) It's cut down on the mini-DDoS attacks and other casual hacking behavior. We haven't had a DMCA complaint since we retired the Airports.

We've had to make very few adjustments to the initial configuration -- a couple of firewall exceptions on the BYOD network and that's it. The system's never gone down, and when one AP failed, Aruba shipped a new one immediately. With the recent firmware's "control plane security" feature, we don't even have to tunnel the middle school's local traffic over to the high school-housed controller and back; I'm fuzzy on the details, the reseller's expert set it up and I don't have to know every nuance. Woohoo.

tl;dr: I love Aruba.

Fly
Nov 3, 2002

moral compass
We've been running the two Unifi APs at work for several weeks, and I think we're happy with them. We have only sixty or so devices on the network, and they work just fine for that.

We did notice that bringing up the management server would cause the APs to go through re-adoption, but we determined that was caused by the management server being brought online with a changed IP address because it did not have a DHCP reservation. We thought there might be some kind of bug, but it was self-inflicted.

I'm planning to get one for home just for the great coverage they seem to provide at just $70.

The two Unifi AP Pro units at church also hum along nicely with no intervention.

chutwig
May 28, 2001

BURLAP SATCHEL OF CRACKERJACKS

nulldev1ce posted:

tl;dr: I love Aruba.

I've had it up the loving wall with Aruba, on the other hand. I'm sure they work well for small to mid-size installations, but our current deployment is about 15 controllers with 3200 APs and 20,000 unique clients at peak, and the scaling is tragically poor. 802.1X is randomly unusable and can take several attempts to authenticate, the controllers sometimes eat DHCP packets, we had to deactivate IPv6 because it exposed a number of severe memory leaks in ArubaOS, AirWave is a piece of poo poo that simply cannot handle the level of wireless activity in our organization, we can't use band steering or mesh networking because it causes a significant percentage of our wireless client base to be completely unable to connect, etc. These are just a few of our complaints that I can recall off the top of my head. When we're in a situation where more than half of our clients are electing to use the unencrypted guest wireless network over the 802.1X employee network because of how unreliable and fractious 802.1X is, that's a bad situation.

Aruba has some good people in their company that I've worked with, but on the whole they seem disorganized and unable to overcome institutional inadequacies. The fact that the PDF report generation in the current beta release of AirWave is based on some code I ended up writing and submitting to them, after 2+ years of us and numerous other AirWave-using customers pleading for it, says to me that they're unwilling or unable to understand what their customers are looking for.

bort
Mar 13, 2003

Has anyone figured out a workaround to this problem? I'm running Cisco controllers.

If a user has a virtual machine on a wireless host, and is using bridged mode for networking, the controller won't hand out a DHCP address to the virtual machine. One of my admins wants to be able to remotely manage a virtual machine on a wireless client, and NAT mode won't work. Anyone figured out a sneaky way to dynamically assign an IP in this scenario?

wwb
Aug 17, 2004

Rather than starting a new thread, I figured I'd start by asking this here.

I help run a pretty significant trade show in the technology / media / entertainment space. Which, in 2012, translates into a couple hundred exhibitors trying to show off there iPad enabled doohickey. Each one of these guys of course needs his own wireless gear and network because they are often dealing with engineering samples that have hardcoded IPs, can't traverse the public internet and other hoo ha. We are stuck dealing with lots of small, special networks for better or for worse.

This has been challenging over the last few years but in 2012 we finally hit the breaking point -- 2.4 ghz was completely unusable on the show floor, including resorting to channels over 11. 5ghz was challenging. We were encouraging anyone on our stage to run off 3g or 4g if possible because it was so bad -- and this is after we went through significant planning exercises. The people who did not go through those exercises typically had stuff that just did not work.

I've now been asked to try and figure out a way to keep wifi usable for both exhibitors and attendees at this event. We've got some ideas internally, but we are far from expert in this and I wonder if any of you have encountered a situation like this and had a successful resolution.

Just to reiterate the facts of the case are:

* One convention show floor, light booth structures, about 200k square feet total.
* Typically some house wifi coming from the ceiling, we can get this turned off though.
* We've never successfully counted APs, but there are at least 300 and probably significantly more.
* Unfortunately, these are paying customers many of whom need a special one-off wifi network so we can't do the logical thing which is to overbuild and provide the wifi in a sane manner.

Please let me know if you've got any questions, looking forward to seeing what goondom can add to this debate.

Nitr0
Aug 17, 2005

IT'S FREE REAL ESTATE
"We've never successfully counted APs, but there are at least 300 and probably significantly more."



......

Are you saying you have 300 ap's with no central control? No wonder none of your poo poo works. Jesus christ.

Hire a professional because you're not going to do this job properly with the information you've given us.

bort
Mar 13, 2003

You do probably need a pro or at least a serious survey. With modern controller infrastructure, you could at least monitor where trouble spots are (e.g. where is there too much 2.4, interference and so forth). This won't help much, since it would be difficult to tell an exhibitor to change his/her configuration. It might be able to work around your exhibitors and allow attendees to use your wireless effectively. High-density deployments with heterogeneous equipment configured by many different people is a difficult challenge for even a seasoned pro. This thread is mostly smaller deployments and the larger ones are often offices where there's central control. I don't think there's any way you could make 2.4 work right and there's certain to be an exhibitor using overlapping channels.

I've only been on the exhibitor side of that equation, and our strategy was to overpower our booth with our own wireless, making everyone else complain... :haw:

wwb
Aug 17, 2004

Nitr0 posted:

Are you saying you have 300 ap's with no central control? No wonder none of your poo poo works. Jesus christ.

Hire a professional because you're not going to do this job properly with the information you've given us.

Yes, we are aware it is a drat near impossible task. Wouldn't be the first time. I'd guess the real number is closer to 500. We've got a few individual booths with 50+ APs, or at least SSIDs. The measurement tool we were using -- the metageek stuff -- basically melted down on the poor laptop that was doing the surveying.

We would look at hiring professionals but we haven't found anyone who does this sort of work -- they all want fixed sites and rational scenarios. This isn't one. Even doing a survey is tough. It is a trade show. Lots of folks don't even turn things up until hours before we open. Gets real fun then because you get 15k attendees with ~5k personal wireless networks walking around.

bort posted:

You do probably need a pro or at least a serious survey. With modern controller infrastructure, you could at least monitor where trouble spots are (e.g. where is there too much 2.4, interference and so forth). This won't help much, since it would be difficult to tell an exhibitor to change his/her configuration. It might be able to work around your exhibitors and allow attendees to use your wireless effectively. High-density deployments with heterogeneous equipment configured by many different people is a difficult challenge for even a seasoned pro. This thread is mostly smaller deployments and the larger ones are often offices where there's central control. I don't think there's any way you could make 2.4 work right and there's certain to be an exhibitor using overlapping channels.

I've only been on the exhibitor side of that equation, and our strategy was to overpower our booth with our own wireless, making everyone else complain... :haw:

This is exactly what happens. End result is nothing works for no one as the noise floor gets to be the entire signal. My understanding of wifi indicates that channels can overlap to some extent, but we get past some extent real quick.

McGlockenshire
Dec 16, 2005

GOLLOCKS!
Require each booth providing it's own access point be enclosed within a Faraday cage. :colbert:

SamDabbers
May 26, 2003



It sounds like there isn't any good solution since a) everybody's allowed to set up their own AP, and b) everybody needs a special snowflake configuration. Without having any control over any of the equipment, maybe the best you can do is give every attendee a list of recommendations for configuration. Here are a couple ideas:
  • Lowest transmit power on all devices
  • Suggest a particular channel for each booth, so you can put non- or minimally-overlapping channels next to each other
  • Use the 5GHz band whenever possible

Nitr0
Aug 17, 2005

IT'S FREE REAL ESTATE
1. Ban all outside access points.
2. Have controller controlled access points that can change power levels and try to send reset packets to any non authenticated AP's.
3. Ban all outside access points.
4. Get a proper wireless survey done.

wolrah
May 8, 2006
what?
I'm now a few weeks in to a two site deployment of nine total (6+3) UniFi LR units. My only complaint so far other than a personal dislike of Java (used for the controller) is the non-standard PoE. 802.3af has been around for some time and most of my sites already have it to support IP phones, I'd have paid a few extra bucks a unit to have it. The Pro units have it, but all of them should.

Devices roam as well as they can be expected to (I usually drop 2-6 pings on both Mac and Windows 8 laptops, Android devices seem to want to hang on a lot longer and require a full signal loss to switch most of the time). Range is excellent, a single one delivered a signal strong enough to stream HD video two buildings down in my apartment complex.

Apparently some had bricking issues with a recent firmware update, but I did not have any trouble and all devices came back up painlessly.

I'm buying a Pro for my apartment soon, 5GHz is something I haven't had yet and really want as 2.4 gets worse around here.

wolrah fucked around with this message at 05:19 on Nov 15, 2012

Ahdinko
Oct 27, 2007

WHAT A LOVELY DAY
I don't know if there's some horrible fear of Zyxel gear as I haven't seen it mentioned, but I had alot of luck with their wireless kit. Had their NWA1100 series stuff with 1 central controller, and about 20 AP's over six floors in a horrible layout. It worked beautifully, had a seperate guest SSID (with a ticket printer that dishes out randomly generated usernames/passwords that work for 4/8/24 hours), VLANs and WPA2-E.

Plus they were 1/4 of the price of the Cisco AP's I was quoted.

wwb
Aug 17, 2004

McGlockenshire posted:

Require each booth providing it's own access point be enclosed within a Faraday cage. :colbert:

To be honest, this is what we'd like to do. It just ruins the aesthethic of the show. Might be some cancer angles for folks who get longer-term exposure.


SamDabbers posted:

It sounds like there isn't any good solution since a) everybody's allowed to set up their own AP, and b) everybody needs a special snowflake configuration. Without having any control over any of the equipment, maybe the best you can do is give every attendee a list of recommendations for configuration. Here are a couple ideas:
  • Lowest transmit power on all devices
  • Suggest a particular channel for each booth, so you can put non- or minimally-overlapping channels next to each other
  • Use the 5GHz band whenever possible

Thanks, this merges with our current thinking. Good to know we aren't completely nuts.

Nitr0 posted:

1. Ban all outside access points.
2. Have controller controlled access points that can change power levels and try to send reset packets to any non authenticated AP's.
3. Ban all outside access points.
4. Get a proper wireless survey done.

Thanks, I'd love to do this if it weren't PAYING CUSTOMERS who want/need their own wifi. Anyhow, #2 sounds interesting -- can you elaborate a bit?

Gism0
Mar 20, 2003

huuuh?
Seems Cisco just bought Meraki for $1.2 billion

http://techcrunch.com/2012/11/18/cisco-acquires-enterprise-wi-fi-startup-meraki-for-1-2-billion-in-cash/

Fly
Nov 3, 2002

moral compass

wolrah posted:

I'm now a few weeks in to a two site deployment of nine total (6+3) UniFi LR units. My only complaint so far other than a personal dislike of Java (used for the controller) is the non-standard PoE. 802.3af has been around for some time and most of my sites already have it to support IP phones, I'd have paid a few extra bucks a unit to have it. The Pro units have it, but all of them should.

You want the Ubiquiti Instant 802.3af Adapter, don't you?

Adbot
ADBOT LOVES YOU

wolrah
May 8, 2006
what?

Not really. If I'm going to have to deal with a bonus box per device in my network closet anyways the dumb power injectors that come with the things are free.

The main benefit of proper PoE to me other than the lack of extra "wire warts" is being able to have PoE wired everywhere and not worry about someone accidentally plugging a computer in to a port with dumb injectors. I like it when everything's just a port number and what that port actually does is defined by switch configuration and what's plugged in to it.

For now though all my currently installed units are mounted to drop ceilings so there's little chance of an accident.

  • Locked thread