topic Re: Client roaming issue between APs in Wireless

Client roaming issue between APs

abdelouahab.brahim1 — Mon, 05 Jul 2021 18:45:06 GMT

hello,

I have a wireless network built with Cisco WLC 5520 (in HA), AP 2800. WLC is running code 8.3.133.0.

Randomly, client roaming goes wrong, all I can found in the debug client is this :

xx:xx:xx:xx:xx:xx : MAC of client

yy:yy:yy:yy:yy:yy : BSSID

*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-Key from mobile xx:xx:xx:xx:xx:xx
*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx Ignoring invalid EAPOL version (1) in EAPOL-key message from mobile xx:xx:xx:xx:xx:xx
*Dot1x_NW_MsgTask_2: Nov 22 09:52:43.707: [PA] xx:xx:xx:xx:xx:xx key Desc Version FT - 0

*Dot1x_NW_MsgTask_2: Nov 22 09:53:52.366: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-key message in invalid state from mobile xx:xx:xx:xx:xx:xx

*apfOpenDtlSocket: Nov 22 09:55:08.983: [PA] xx:xx:xx:xx:xx:xx Recevied management frame REASSOCIATION REQUEST on BSSID yy:yy:yy:yy:yy:yy destination addr yy:yy:yy:yy:yy:y2

Every time it's the same debug, and loss of connection until the client reasscoates with the AP with reassociation request.

As you can see in this debug, about 1 minute and 16 seconde of loss of ping.

We use [WPA2][Auth(802.1X + CCKM)] with a remote radius server (ACS) a cross the WAN.

Any help is much appreciated.

regards,

Brahim,

Re: Client roaming issue between APs

abdelouahab.brahim1 — Fri, 21 Feb 2020 14:59:22 GMT

hello,

I think somehow the client send eapol pkt with the key version 1 that's ignored by the controller (version 2).

is there a way to ignore the version check in the controller ?

*dot1xSocketTask: Nov 22 09:53:52.365: [PA] xx:xx:xx:xx:xx:xx validating eapol pkt: key version = 2

*Dot1x_NW_MsgTask_2: Nov 22 09:53:52.366: [PA] xx:xx:xx:xx:xx:xx Received EAPOL-key message in invalid state from mobile xx:xx:xx:xx:xx:xx

*apfOpenDtlSocket: Nov 22 09:55:08.983: [PA] xx:xx:xx:xx:xx:xx Recevied management frame REASSOCIATION REQUEST on BSSID yy:yy:yy:yy:yy:yy destination addr yy:yy:yy:yy:yy:y2

Thanks in advance,

Re: Client roaming issue between APs

Rich R — Sat, 22 Feb 2020 13:48:31 GMT

8.3.133.0 is very old and with no software maintenance support - see https://www.cisco.com/c/en/us/products/collateral/wireless/8500-series-wireless-controllers/bulletin-c25-742339.html
If you *must* run 8.3 for some reason then you should be running 8.3.150.x Escalation code which TAC will still support - see https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html#anc11
If you don't have to stay on 8.3 (eg. for very old APs) then you should seriously consider moving to 8.5 or later.

Re: Client roaming issue between APs

abdelouahab.brahim1 — Wed, 26 Feb 2020 14:45:45 GMT

Hello,
Thank you for your reply, we moved to 8.5.151.0 recommanded by cisco.
We are in observation period.
Regards,

Re: Client roaming issue between APs

OddievenInc — Thu, 04 Jun 2020 17:09:50 GMT

Hi
Any update on this, please?

Re: Client roaming issue between APs

abdelouahab.brahim1 — Thu, 04 Jun 2020 18:56:36 GMT

Hello,

The upgrade solved the problem.

Regards,