Warehouse Wi-Fi: Scanner Roaming and a Renewed Internal CA

The numbers point to co-channel interference, not coverage. A 5 GHz deployment has roughly 24–25 non-overlapping 20 MHz channels across UNII-1, UNII-2A, UNII-2C and UNII-3 (exact counts depend on the regulatory domain). At 80 MHz that collapses to about six usable channels for 38 APs: a 6:1 reuse pattern with heavy overlap. Overlapping 80 MHz cells raise the noise floor, push retries to 38% and utilisation to 72–84%, and force clients to hold on to a serving AP far too long because the client only roams when the signal is nearly gone.

Recommended configuration:

• Move the aisles to 20 MHz. Scanners need range and reliability, not throughput. Twenty-four 20 MHz channels for 38 APs gives roughly 1.5:1 reuse. Use 40 MHz only in the low-density office corner if a survey supports it.
• Disable the 2.4 GHz radios unless a documented legacy device needs them. They add airtime overhead and are not used by the scanners.
• Disable the low rates (1, 2, 5.5, 11, 6, 9, 12, 18, 24 Mbps) on 5 GHz so clients roam at a sensible SNR instead of at the edge of the cell.
• Enable 802.11k neighbour lists and 802.11v BSS Transition Management on the SSID. Enable 802.11r only after confirming the scanner and tablet firmware supports fast transition; a failure there is worse than slow roaming.
• Take RRM out of startup mode, run a manual channel plan for the aisles, then leave RRM in monitor mode so it does not reassign channels under load.

Narrowing from 80 to 20 MHz also buys roughly 6 dB of noise-floor improvement, which directly addresses the −71 dBm worst-case reading.

EAP-TLS is mutual authentication: ISE validates the client certificate chain against a trusted root in its own trusted-certificate store, and the supplicant validates the ISE server certificate against the client's trust store. A renewal can break either direction.

The most likely cause given that this is a small subset is a chain mismatch introduced by the renewal, in one of two forms:

1. The laptops that fail had their certificates reissued by the new issuing CA, but the new root or intermediate is not yet in ISE's trusted certificate store. ISE cannot build a chain and returns the unknown-CA style failure.
2. The old root was removed from ISE's trusted store immediately, so the laptops still holding old certificates fail. The 4,960 that work are the ones whose chain happens to terminate in something ISE still trusts.

Work the problem in order:

• Read the actual failure reason in ISE Live Logs (Operations > RADIUS > Live Logs) for one failing MAC. It distinguishes an untrusted client chain from a server-certificate or CRL problem.
• Check the chain ISE presents with openssl s_client -connect <psn-fqdn>:8443 -showcerts and confirm the PSN certificate's SAN matches the FQDN the supplicant is configured to validate.
• Confirm the new root and intermediate are loaded in ISE under Trusted Certificates, and keep the old root trusted until every endpoint has re-enrolled.
• Verify the CRL and OCSP URLs in the new certificates are reachable from the PSN, because an unreachable revocation point also fails the handshake.
• Push the new root to clients by GPO and let autoenrollment reissue the 40 certificates.

Not a fix: disabling certificate revocation checking to make the errors go away.

Measure the same counters before and after, at the same time of day, because shift patterns change the load dramatically.

• Retry rate per AP and per SSID: target under 15% from the current 38%.
• 5 GHz channel utilisation at peak: target under 50%. Above 60% with 20 MHz channels means the channel plan still has a reuse problem.
• Roam latency: run a continuous ping or ARP test from a scanner walking a full aisle loop and count gaps over 200 ms. Scanner sessions should not need a full re-authentication on every roam if 802.11k/v are working.
• RSSI and SNR at the worst aisle end: aim for −67 dBm or better and SNR of 25 dB or more. The 4 dB improvement from 80 to 20 MHz should show here.
• Per-radio channel assignment: confirm no channel is used more than twice in the same physical area, and that no AP is on a channel adjacent to a strong neighbour where it matters.
• ISE authentication success rate for the laptop SSID and the number of EAP-TLS failures per hour.

If retries fall but roam gaps stay above a second, the remaining problem is client behaviour rather than RF: check whether the scanner firmware supports 802.11v and whether the WLC is actually sending BSS Transition requests. Report improvements as a before/after table so the operations team can defend the change without new APs.