topic Re: 802.11r Handoffs Failing: 802.11r Key Cache look up failed in (re)-assoc req in Wireless

802.11r Handoffs Failing: 802.11r Key Cache look up failed in (re)-assoc req

Mon, 05 Jul 2021 14:31:50 GMT

I am trying to set up a wireless LAN using two Cisco 3602i APs on a Virtual WLC running software version 8.2.160.0. My goal is to have an iPhone 6s client using Voice-over-WiFi be able to fast-roam between these two APs using 802.11r/802.11k/802.11v without dropping the voice call.

As far as I can tell, I have set everything up for this according to Cisco and Apple recommendations, but the handoffs continually fail. Running 'debug client <iphone-mac-address>' on the controller produces the following message when the handoff attempts fail:

Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req

Unfortunately, a Google search for "key cache look up failed" returns only one result - an un-annotated pastebin dump.

Here is the vWLC configuration for the WLAN in question, id '2', SSID 'phone-test-5g':

https://pastebin.com/DaSqp5cT

And here is the complete output of a 'debug client ' capturing a failed roam/handoff event:

https://pastebin.com/sENSsnpA

I have tried a fairly wide variety of configurations but have not been able to get this to work using any combination of settings. If anyone has any suggestions, I will greatly appreciate hearing them.

It seems the cause of this

Tue, 15 Aug 2017 13:41:50 GMT

It seems the cause of this problem is that the vWLC is not distributing the 802.11r key cache info to the APs:

ypsi-wifi-1#show capwap reap dot11r

Total number of dot11r cache entries = 0

DOT11R Cache Entries:

HW Address Life Time(in sec) BSSID R0KhId R1KhId vlanOverride client Acl

ypsi-wifi-1#

But I don't know why it isn't. Do any of you have any ideas why it isn't distributing the key cache info, or what else I might check to investigate further?

Hi Mate,

sremk — Tue, 15 Aug 2017 13:54:57 GMT

Hi Mate,

Can you make sure all the aps in that location belongs to same flex connect group if not configure flexconnect group and map all these aps under the same group.

Thanks

Sreejith

When I first set this up, I

Tue, 15 Aug 2017 14:30:49 GMT

When I first set this up, I had neglected to configure a flexconnect group and add the APs to it, but creating the group and adding the APs did not change the behavior. I even rebooted the APs and controller after making the change in case that was necessary.

(Cisco Controller) >show flexconnect group detail fc_def_grp

Number of AP's in Group: 2

7c:ad:74:85:09:8e ypsi-wifi-1 Joined Flexconnect
fc:5b:39:9b:b4:98 ypsi-wifi-2 Joined Flexconnect

Hi Mate,

sremk — Tue, 15 Aug 2017 14:50:31 GMT

Hi Mate,

Are we roaming between only these two aps?

Also what is the dot11r config, is it over the ds or over the air?

Thanks

Sreejith

Greetings,

Tue, 15 Aug 2017 15:44:38 GMT

Greetings,

For now, those are the only two APs in the system. I currently have dot11r configured for over-the-air, but I have also tried it in over-the-ds mode and run into the same problem.

Cheers,

Rusty

Thanks for the clarification.

sremk — Tue, 15 Aug 2017 17:15:59 GMT

Thanks for the clarification. Need to check two things to rule out the things here.

1. Can we test this in open ssid and see seamless roaming is happening between these aps?

2. Do we have 15- 20 percent overlap between the aps which is recommended for seamless roaming?

Thanks

Sreejith

Greetings, and thanks for

Wed, 16 Aug 2017 23:20:11 GMT

Greetings, and thanks for your help,

I set the WLAN to open mode (no authentication whatsoever) and the client was able to roam seamlessly between the two APs.

I think there is pretty good overlap between the two APs. As you walk back and forth between the two APs, the RSSI from each (as displayed on the client) is -65 dBm at the midpoint.

Thanks again,

Rusty

Thank you for the test.

sremk — Thu, 17 Aug 2017 00:26:49 GMT

Thank you for the test.

What is the authentication type we are using on the non working one?

Thanks

Sreejith

When it's not working, we are

Thu, 17 Aug 2017 00:36:59 GMT

When it's not working, we are using WPA2-AES PSK. I have tried having both 'PSK' and 'FT-PSK' enabled, in an effort to allow FT and non-FT clients to use the same SSID, and I have also tried having only 'FT-PSK' enabled. In the pastebins in the original post, I had only 'FT-PSK' enabled, as follows:

Security

802.11 Authentication:........................ Open System
FT Support.................................... Enabled
Static WEP Keys............................... Disabled
802.1X........................................ Disabled
Wi-Fi Protected Access (WPA/WPA2)............. Enabled
WPA (SSN IE)............................... Disabled
WPA2 (RSN IE).............................. Enabled
TKIP Cipher............................. Disabled
AES Cipher.............................. Enabled
OSEN IE.................................... Disabled
Auth Key Management

--More-- or (q)uit
802.1x.................................. Disabled
PSK..................................... Disabled
CCKM.................................... Disabled
FT-1X(802.11r).......................... Disabled
FT-PSK(802.11r)......................... Enabled
PMF-1X(802.11w)......................... Disabled
PMF-PSK(802.11w)........................ Disabled
OSEN-1X................................. Disabled
FT Reassociation Timeout................... 20
FT Over-The-DS mode........................ Disabled
GTK Randomization.......................... Disabled
SKC Cache Support.......................... Disabled
CCKM TSF Tolerance......................... 1000

Hi Mate,

sremk — Thu, 17 Aug 2017 16:32:33 GMT

Hi Mate,

Any possibility of testing this in 8.3 latest as the release notes of 8.3.122.0 says apple devices are tested.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn83mr2.html

Also, can we make sure we are following attached doc on dot11r, k and v.

Thanks

Sreejith

Re: 802.11r Handoffs Failing: 802.11r Key Cache look up failed in (re)-assoc req

happy.nidjo — Thu, 02 Nov 2017 13:43:49 GMT

Hello,

i have exactly the same issue, did you know how to fix it?

thanks in advance

Mohammed,

Re: 802.11r Handoffs Failing: 802.11r Key Cache look up failed in (re)-assoc req

robvreedepvh — Mon, 22 Jan 2018 11:11:25 GMT

I'm seeing this behaviour on v8.2.151 too. Doesn't seem to be fixed in v8.2.166

Will upgrade to v8.3.122 or v8.3.133; should be fixed in thoses releases

Association Failed on REAP AP BSSID

Re: When it's not working, we are

Eduardo Cruz — Thu, 26 Apr 2018 20:00:27 GMT

Hello

I'm having same problem with vWLC 8.0.152 and iOS 11. Did you find some solution?

Re: 802.11r Handoffs Failing: 802.11r Key Cache look up failed in (re)-assoc req

Eduardo Cruz — Fri, 27 Apr 2018 18:51:10 GMT

Hi Mohammed,

Did you find a solution for this problem?

Thank you

Re: 802.11r Handoffs Failing: 802.11r Key Cache look up failed in (re)-assoc req

robvreedepvh — Sat, 28 Apr 2018 12:12:51 GMT

Yes, we did fix the 802.11r issue by placing the FlexConnect AP’s in flexconnect groups (this is different from AP groups).

After placing them in the flexconnect groups, 802.11r FT started working.

Note: there are some limitations to the number of AP’s in a flexconnect group, differs per WLC model.

our model (5520) supports 100 AP’s in one flexconnect group.

The 5508 supports 25 in one group. If you have more, create multiple flexconnect groups (i.e. per floor or 2 floors).

Hope this helps, please reply if it does.

Thanks,

Rob