Basic WiFi roaming in SoHo

maigonis · October 31, 2020, 9:47pm

Another potential problem with roaming …

We can see that devices in IOS, Android, Windows 10, massively start to switch to private MAC addresses. (The user was never asked to enable this, the update just did it!) The rules on how dynamic those changes in MAC addresses are, are not clear to me, but I see a devastating consequence in DHCP lease use, but also a potential major problem in roaming.

Not only is there a new MAC+IP address every hour, consuming DHCP leases (current lease timeout is 36 hours), one per connected network (different subnets have different SSID’s) , but now even while roaming : changing AP (or maybe also from 2.4GHz to 5 GHz WLAN with same SSID) with the same SSID (and of course subnet) is changing the MAC and getting a new IP address.
.
.
Klembord-2.jpg
.
.
Even when the client is maintaining the same MAC (and IP address) for one full hour for every wireless connection possibility, there a fundamental changes.

DHCP leases are consumed more frequently

Roaming is switching the MAC address now. This is totally different for any “switch/bridge” MAC-table/Hosts-table that is not corrected by the new flow as before.

Worst is the different IP address. Even if NATted in the gateway (the internet server sees no difference) the session is interrupted or maintained to the wrong LAN IP address. The gateway must set up a new connection to the new IP address. The client must initiate that connection. This will clearly be an interruption just as switching between different SSID/subnets is.

MAC based access-lists and MAC based cookies in the Portal … well that is yet another changing world.

EDIT … will be a challenge … now 1 user walking between 4 AP’s … real load is 200 users and 25 AP’s … will explode !
.
Klembord-3.jpg
.
With an iPhone you select different SSID’s. With an Applewatch and new AP specific test SSID’s???
MAC addresses are from the private range! Should we block them all ??? Can we filter this with MAC-address ranges in the access-list ? How can we instruct a large random public to turn this off, with success ??? (Src MAC Mask Filter in Bridge?)
https://www.blackmanticore.com/fc5c95c7c2e29e262ec89c539852f8fb
Like private IP address ranges (defined in RFC 1918), there are also private MAC address ranges. These are called Locally Administered Address Ranges which are never used by devices or other vendors. MAC addresses in these ranges can be safely used, assuming they are unique within your network:

x2-xx-xx-xx-xx-xx
x6-xx-xx-xx-xx-xx
xA-xx-xx-xx-xx-xx
xE-xx-xx-xx-xx-xx

EDIT: The Applewatch learned the SSID/password combinations from the iPhone, and did connect to all the same SSIDs, including the test SSIDs in the same subnet during installation.
‘There is hope’

I notice this on my Samsung devices too and I agree that this is st*pid.