Wireless Access

 View Only
Back to discussions
Expand all | Collapse all

School Wifi with Airgroup, Airplay, and Airprint questions

This thread has been viewed 91 times

  • 1.  School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Jun 08, 2022 05:42 PM
    Hi All,

    I'd like to start this discussion to see if anyone else who has a similar network can give any feedback on how they have their network setup.  Here's what we have:
    1. We have an Aruba Wifi network + Clearpass with Employee, student, BYOD, and Guest wifi.  All on different subnets.
    2. we have Apple TV in the classrooms that all wifi networks have access to via Airgroup.
    3. we have Airprint printers.  different WiFi networks have access to different printers.  We use a server called Presto that advertise the printers via DNS.  This allows us to control which WiFi get access to which printers.

    So here's the issues I'm having and trying to solve:
    1. it's just not very reliable. We have problems with incomplete lists of Apple TV.  If you tend to use one Apple TV often, there's a good chance that is the one that will not advertise for you.
    2. or another thing we see with Apple TV advertisements is lets' say room 20 Apple TV will not be available for 4 people, but the 5th person can see it.
    3. another issue we have is printers appearing offline for MacOS and iOS devices.  Most of the time toggling the wifi fixes it, but not always.  Sometime you have to reboot the device and sometimes even that doesn't bring the printer back.
    4. the other issue I'm facing is printer sharing on the BYOD wifi.  If a BYOD user has a printer shared, it advertises to the entire network.  Then users try to install that printer which is causing a bunch of confusion.

    So if anyone can give any feedback about their use with Airgroup and maybe some successes or design ideas they have.  We have never had much luck with Airgroup.  and since Airgroup is not required for our printing solutions I'm suspicious it's adding another layer of complexity we don't need.


  • 2.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Jun 08, 2022 10:51 PM
    I would say in general, get a VAR or reseller to design your Airgroup network exactly the way you want it, because there are many ways to deploy Airgroup and some ways are more inefficient than others.

    If you want to proceed, if you haven't, please take a look at the airgroup deployment guide on asp.arubanetworks.com here:  https://asp.arubanetworks.com/downloads/documents/RmlsZTphYjE4MmJlYS0wNzFlLTExZWItODE2Zi1kM2IyZWU0NjNjZGY%3D  That will give you some principles to start with or things to fine-tune, if you haven't already.

    You can improve performance of Airgroup by:

    Limiting the services you advertise
    Limit the services you advertise by role or VLAN.
    Limiting the users you advertise to by ap-name (this will only advertise say an Apple TV device if you are on the AP or an adjacent AP that the device is tied to in Airgroup).  For wired Apple TVs, you will have to enter the AP that the Apple TV is closest to either in ClearPass or in ArubaOS.


    Your questions:

    1. We have an Aruba Wifi network + Clearpass with Employee, student, BYOD, and Guest wifi.  All on different subnets. OK
    2. we have Apple TV in the classrooms that all wifi networks have access to via Airgroup. OK
    3. we have Airprint printers.  different WiFi networks have access to different printers.  We use a server called Presto that advertise the printers via DNS.  This allows us to control which WiFi get access to which printers.  The interaction between the printer server and the clients needs to be explored and resolved.  Either you are advertising the printers via Clearpass or you are using a print server to advertise.  Long story short, your print server can provide ip connectivity to printers from clients, but ClearPass would be the gatekeeper or what printers are seen by what users.  Again, tying the printer to an AP name in Clearpass and then only advertising airprint when the user is associated to an AP nearby is probably the best solution.

    So here's the issues I'm having and trying to solve:
    1. it's just not very reliable. We have problems with incomplete lists of Apple TV.  If you tend to use one Apple TV often, there's a good chance that is the one that will not advertise for you.  Limiting the number of devices advertised will make that list more reliable.
    2. or another thing we see with Apple TV advertisements is lets' say room 20 Apple TV will not be available for 4 people, but the 5th person can see it.  This could be a function of not limiting the number of devices advertised.
    3. another issue we have is printers appearing offline for MacOS and iOS devices.  Most of the time toggling the wifi fixes it, but not always.  Sometime you have to reboot the device and sometimes even that doesn't bring the printer back.  It all depends on how the printer is discovered or attached to.  That could be a network issue, but you should open a technical support case to find out why that happens.
    4. the other issue I'm facing is printer sharing on the BYOD wifi.  If a BYOD user has a printer shared, it advertises to the entire network.  Then users try to install that printer which is causing a bunch of confusion.  If a BYOD user is sharing a printer, it should only appear for that user, and not the entire network.  You should check your CPPM configuration.

    ***Please note that these answers are of the opinion of one person, who is guessing about your deployment based on limited information.  I would still open a technical support case and troubleshoot your connectivity issue.  I hope that others on this forum will also give you ideas about your issue***

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card
    ------------------------------



  • 3.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Jun 09, 2022 12:19 PM
    Wow thanks for taking the time to write the reply.  We'll take a look at all of this.  We have a VAR.  I might go that way or take a look at the guide and give it a go myself.  Summer is coming so I can have a bit more freedom with service uptime since we are a school. 

    I used to advertise our Apple TV based on AP group.  Each building is an AP group on campus, but Airgroup kept breaking.  I can take another look at your other ideas too.  It sounds like less advertisements the better.

    As far as printing, that makes sense.  Does Clearpass have a way to advertise a wired printer to Airprint?  I could bypass our Airprint server entirely.

    Original Message


  • 4.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Jun 09, 2022 12:54 PM
    So you should use Autoassociate based on AP name.  That will return far fewer devices to users and will improve performance.

    In ClearPass you need to have gone into ClearPass Guest and go to Administration> Controllers and added your controller username and password so that ClearPass can import roles, ap-groups and ap-names.  You can test if this is working by clicking on Read Configuration, then Show details to see if your ap and ap-group information is there.  After that you will go to Clearpass guest and go to Devices> Create devices.  Enter the wired mac address, the friendly name of your Apple TV, make sure "Enable Airgroup" is checked, make sure ownership is shared.  You should be able to click on the shared locations box and be able to select the access point that you want the wired Apple TV to be associated with.  That is all you would typically have to do.  Using this method, you could theoretically bypass your print server, as  long as (1) the wired AppleTV shares a VLAN with your controller so it can see MDNS advertisements and (2) That wired device is routable to the clients that need to reach it.

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card
    ------------------------------

    Original Message


  • 5.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Mar 22, 2024 10:32 AM

    Hi, 

    I have a very similar environment to you. I use Presto with Aruba Airgroup as well, although we are not currently using ClearPass. I consistently, but intermittently have the exact same issues you are describing.

    I have had intermittent AppleTVs that disappear for specific users. But more importantly I am experiencing the same behaviors with printers advertised through Presto that disappear from specific user MacBooks without any reason.

    I can usually fix this with a WiFi toggle or force quitting mDNSResponder and related Airplay / Airprint services on the MacOS device, but this too regular of an issue to keep addressing one at a time.

    I am desperate to find a solution for this. 

    Were you ever able to get this resolved? If so, Can you share some of your process?




  • 6.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Mar 23, 2024 09:13 AM

    What version of ArubaOS are you running? If you search the discussion forums for the past 2 years, you'll find a few threads about my immense struggles with AirGroup. Ever since moving to Aruba OS 8, I've experienced everything that the original poster has mentioned. We upgraded to 8.10.0.8 last Summer and it completely broke AirPrint and we had to revert back to 8.7 which is where we remain today.

    I was told that 8.10.0.10 contains some important fixes for AirGroup but I can't move to that until the Summer.


    Original Message


  • 7.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Mar 24, 2024 02:20 AM

    8.10.0.10 is available since Feb and indeed it has a few airgroup fixes. You can check the release notes from HP Networking Support portal .



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------

    Original Message


  • 8.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Mar 26, 2024 01:36 PM

    Thanks for the replies.

    Currently on ArubaOS 8.11.1.1

    I plan to update to 8.12 in the next 1-2 weeks.

    It does partially seem that I need the client MacBook to clear it's DNS/mDNS cache in order for it to reestablish connection to the printers. Until I refresh the dns-cache it can see the printers advertised, but it cannot actually print using Airprint.

    I guess it's worth noting that the address of my printers in Presto are handed out as Lookup Zone records on my DNS Server. This in theory allows for a seamless Zero Config printing solution. The printers are not actually listed in the Airgroup. I have Airprint enabled only on my student BYOD network. 

    Update: looking closely at the console logs for a few clients while they are actively having this issue, it looks like there is definitely an issue resolving address and authenticating when trying to reach the advertised printers. I'm not sure if that is clearly the cause, or if mDNS is still at play here.

    The MacOS device needs to verify the address and establish connection to the printers, and it looks like it is doing it through a combination of unicast DNS and mDNS, but I'm a little fuzzy on how the DNS resolver tries to accomplish this on MacOS.

    I will check the DNS records again and see if there is something that needs to be fixed or updated.

    If anyone has any further insight on this, I would be forever in your debt.


    Original Message


  • 9.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Mar 26, 2024 01:42 PM

    Can you please update this thread after you've upgraded to 8.12? I'm extremely curious to find out if it actually fixes the AirGroup issue or not. OS 8 has been a thorn in my side ever since we've moved to it 3 years ago. 


    Original Message


  • 10.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Mar 26, 2024 02:14 PM

    Hi.  I'm the one who started this old thread.  It appears I did resolve these issues.  First, I switched from Presto to Papercut Mobility print.  It's free or very reasonable with a support contract.  Their support people are also helpful.  I have not had to toggle a single MacBook Wi-Fi to print since switching.  Sorry Lanny.

    The other issues with performance, in my opinion have also been resolved by switching Airgroup to Autoassociate "per-AP."  So the user will see all the Apple TV associated with the AP they are connected to and all it's neighbors.  In our environment, users see a list of about 7 Apple TV that are closest to them.  It works great.

    The other thing I did was move my Apple TV to their own VLAN and role.  So when a user gets connected to the school Wi-Fi they get the employee role.  The Apple TV gets a new role called AppleTV, which puts them on their own VLAN.  I'm not sure if this is responsible for the added performance we see  but maybe it does.  The Apple TV used to be on the same VLAN as the employee devices.  I wonder if that matters.
    I haven't received a Apple TV performance complaint all year. 


    Original Message


  • 11.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Mar 27, 2024 12:14 AM

    yes it is always a good practice to have the ATVs on their own subnet and their own role. This way you'll have a better control.



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------

    Original Message


  • 12.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Mar 27, 2024 06:38 AM

    A few questions:

    1. Is putting Apple TVs on their own VLAN/role really best practice as recommended by Aruba? If it makes things work better, then fantastic. I've just never seen it recommended as a best practice by Aruba.
    2. What is the purpose of using a product like Presto or Papercut Mobility? The Aruba controllers are supposed to be managing access to AirGroup servers. 

    Original Message


  • 13.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Mar 28, 2024 03:25 AM

    Apple TVs on their own VLAN is what I've heard Apple recommends, and then relying on bluetooth discovery.

    Presto and Papercut Mobility print allow clients to perform DNS-SD via unicast DNS zones instead of multicast DNS (which AirGroup controls). Eg I have reverse DNS records

    b._dns-sd._udp.0                IN      PTR             0.0.20.10.pc-printer-discovery.
    lb._dns-sd._udp.0               IN      PTR             0.0.20.10.pc-printer-discovery.

    and pc-printer-discovery is set to forward to the Papercut server. See https://www.rfc-editor.org/rfc/rfc6763.html https://www.papercut.com/kb/Main/MobilityPrintDNSRecordExamples/ https://www.papercut.com/help/manuals/mobility-print/set-up/configure/discover-printers-dns/


    Original Message


  • 14.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Mar 28, 2024 07:11 AM

    I'm certainly not opposed to creating a new VLAN and moving all of our Apple TVs over to it if it's considered best practice by Apple. However, I've just never seen this documented anywhere. Do you have a source that you can link to?


    Original Message


  • 15.  RE: School Wifi with Airgroup, Airplay, and Airprint questions

    Posted Apr 02, 2024 12:11 AM

    I asked on macadmins.org slack and they pointed at https://support.apple.com/en-au/guide/deployment/dep9151c4ace/web but it doesn't contain the separate VLAN advice which only seems to come from Apple SEs via email. I've asked them to update it, we'll see if they do or not.


    Original Message


Related Content