topic Re: 802.1x authentication on PSK key mgmt? in Wireless

802.1x authentication on PSK key mgmt?

danletkeman — Sun, 04 Jul 2021 00:58:05 GMT

Hello,

I'm setting up a new 5508 WLC (the first wlc I have ever setup) and I have my WLAN setup with our existing WPA/TKIP ssid for transitioning our clients from our existing autonomous system to the wlc. I have selected PSK as the key mgmt and I can get the client's to connect for a few minutes but I keep seeing these errors:

Fri Aug 21 08:50:05 2009 Client Excluded: MACAddress:00:21:00:f9:dd:50 Base Radio MAC :00:23:eb:27:e3:b0 Slot: 1 User Name: unknown Ip Address: unknown Reason:802.1x Authentication failed 3 times. ReasonCode: 4

I don't have nor do I want 802.1x enabled. Is there something I need to disable either on the client or the controller?

Thanks.

Dan.

Re: 802.1x authentication on PSK key mgmt?

Robert.N.Barrett_2 — Fri, 21 Aug 2009 14:12:27 GMT

Congrats on getting your first controller set up. Since you don't have any 802.1X configured, could it be that the client in question is trying to use an incorrect PSK?

Re: 802.1x authentication on PSK key mgmt?

danletkeman — Fri, 21 Aug 2009 15:39:55 GMT

I don't think so. All of the clients connect, but then get disconnected with the 802.1x error message.

Dan.

Re: 802.1x authentication on PSK key mgmt?

danletkeman — Fri, 21 Aug 2009 16:36:02 GMT

If I click on the client and look at the client details it shows under the policy manager state that 802.1x is required. Is there something configured wrong on the client?

Clients > Detail

Client Properties

MAC Address 00:21:00:f9:dd:50

IP Address

Client Type

WGB MAC Address

Number of Wired Client(s)

User Name

Port Number

Interface

VLAN ID

CCX Version

E2E Version

Mobility Role

Mobility Peer IP Address

Policy Manager State 8021X_REQD

Management Frame Protection

Re: 802.1x authentication on PSK key mgmt?

danletkeman — Sat, 22 Aug 2009 20:41:31 GMT

I have come across some more information reguarding my problem.

When the lap cannot connected to the wlc then everything works! The clients can connect just fine without problems. As soon as I take the acl of the switch port and allow the lap to connect back to the controller, the client's cannot connect.

Re: 802.1x authentication on PSK key mgmt?

danletkeman — Sat, 22 Aug 2009 22:11:34 GMT

Just another note.

When i set the Wlan to no authentication (open system) then I can connect to the ap when it is in h-reap mode and communicating with the controller. When i have the Wlan set to wpa/aes/psk i cannot connect.

Is there a know bug in 6.0.182.0?

Re: 802.1x authentication on PSK key mgmt?

kristoferheyl — Wed, 26 Aug 2009 06:08:42 GMT

I had a similar problem a while ago, caused by WCS not setting the PSK correctly on the WLC. Cisco TAC informed me that the error message not necessary is a dot1x error message, it can also indicate a PSK error (wrong key).

Are you using WCS to push the PSK to the WLC?

Re: 802.1x authentication on PSK key mgmt?

danletkeman — Wed, 26 Aug 2009 16:41:58 GMT

No I am not using WCS. I contacted TAC and it looks like it might be a bug in the 6.x software. There next step was to re-create it in there lab.

Re: 802.1x authentication on PSK key mgmt?

Robert.N.Barrett_2 — Thu, 27 Aug 2009 03:44:31 GMT

If you are using WPA with AES, then I would change that setting - either use WPA with TKIP, or use WPA2 with AES (even if that does not solve your problem). Even though you are supposed to be able to mix and match WPA/WPA2 and TKIP/AES, I have seen some clients that work better using WPA/TKIP or WPA2/AES.

Re: 802.1x authentication on PSK key mgmt?

danletkeman — Thu, 27 Aug 2009 16:41:23 GMT

It's not that either. I have tried every combination of WPA and WPA2...the only ones that work is WEP or Open System.

WPA and WPA2 work when the ap connection to the controller is lost. So it looks like the ap is not operating in H-Reap mode when it has a connection to the controller.

Re: 802.1x authentication on PSK key mgmt?

mcoverdi_2 — Fri, 13 Nov 2009 06:28:39 GMT

Does your PSK have any numbers, special characters or is it exceptionally long? Try temporarily changing the PSK to something short with lower case characters only to see if that allows you to connect.

Re: 802.1x authentication on PSK key mgmt?

danletkeman — Fri, 13 Nov 2009 14:01:08 GMT

I fixed the problem a while ago with a restart of the controller. I had never restarted it after the initial bootup.

Re: 802.1x authentication on PSK key mgmt?

Lukasz.Slemp — Thu, 09 Dec 2010 07:44:22 GMT

Hey,

I have same problem with Cisco 2100 Series WLC on software version 7.0.98.0.

I get a lot of error messages in Log Monitor which look like these:

0	Thu Dec 9 09:00:28 2010	Client Excluded: MACAddress:(..................) Base Radio MAC :(..................) Slot: 0 User Name: unknown Ip Address: (..................) Reason:802.1x Authentication failed 3 times. ReasonCode: 4
1	Thu Dec 9 08:57:09 2010	Interference Profile Failed for Base Radio MAC: (..................) and slotNo: 0
2	Thu Dec 9 08:53:43 2010	Client Excluded: MACAddress:(..................) Base Radio MAC :(..................) Slot: 0 User Name: unknown Ip Address: (..................) Reason:802.1x Authentication failed 3 times. ReasonCode: 4
3	Thu Dec 9 07:57:15 2010	Client Excluded: MACAddress:(..................) Base Radio MAC :(..................) Slot: 0 User Name: unknown Ip Address: (..................) Reason:802.1x Authentication failed 3 times. ReasonCode: 4
4	Thu Dec 9 07:54:10 2010	Client Excluded: MACAddress:(..................) Base Radio MAC :(..................) Slot: 0 User Name: unknown Ip Address: (..................) Reason:802.1x Authentication failed 3 times. ReasonCode: 4
5	Thu Dec 9 07:50:42 2010	Client Excluded: MACAddress:(..................) Base Radio MAC :(..................) Slot: 0 User Name: unknown Ip Address: (..................) Reason:802.1x Authentication failed 3 times. ReasonCode: 4

I'm not using 802.X authentication, it's just WPA/TKIP ...not even WPA2/AES. Each client gets disconnected few times per day. Auth fails like you see above, but for the most time connection just works. Not as good as I'd want it to, but it works, somehow.

I have also set up two WLANS for other devices like printers etc - it works just fine. I mean - no errors, no disconnects, it works perfectly, but why the hell is WPA not working?!

Second bigger problem is that every computer connected via WIFI is loosing one ping packet every minute. I have WLC -> 7 x AP -> End devices.

Everything till AP's is connected via ethernet, then it's wifi connection. When I'm pinging WLC or AP's from lan connected PC it works fine, but when I'm pinging wifi connected end devices (6 pc's) - each one is loosing one packet in exact, same time - every minute.

When I'm doing the same but from second side - wifi connected pc pinging AP's, WLC, lan pc - I loose one ping packet to each device including AP, WLC, other end devices.

It's definately fault in WLC configuration because I loose these packetes on AP's <-> WIFI devices. Any idea, any clue? I'm not sure which setting is responsible for that.

Thanks in advance for any hints, suggestions.

Regards,

Łukasz

Re: 802.1x authentication on PSK key mgmt?

George Stefanick — Sun, 12 Dec 2010 03:46:09 GMT

I have a similar issue on 7.0.98.0 / 5508.

Version 7.0.98.0 / 5508- WPA/TKIP psk doesn't work

Version 7.0.98.0 / 5508- WPA2/AES psk works

downgraded to 6.0.199.0

Version 7.0.98.0 / 5508- WPA/TKIP psk works

Version 7.0.98.0 / 5508- WPA2/AES psk works

upgraded back to 7.0.98.0

Version 7.0.98.0 / 5508- WPA/TKIP psk doesn't work

Version 7.0.98.0 / 5508- WPA2/AES psk works

I called TAC and they mentioned there was no known issues. Although I have not had a chance to work with them on the issue.

802.1x authentication on PSK key mgmt?

daniel.yuste.aroca — Fri, 22 Feb 2013 11:04:16 GMT

Hello all.

Right now I am facing the same issue described here. My controller is running software version 7.2.103.0.

Did you manage to find a cause for this failure and/or a solution for it?

Thanks!!!

802.1x authentication on PSK key mgmt?

Saravanan Lakshmanan — Mon, 25 Feb 2013 04:44:36 GMT

use wpa aes or try the below change to see if that make any difference

disable client exclusion

disable tkip countermeasure

802.1x authentication on PSK key mgmt?

maldehne — Mon, 25 Feb 2013 08:38:21 GMT

Does the issue happen with all your clients or certain client?

Did you verify the driver version of your wireless adapter? make sure to have it updated to the latest firmware version.

802.1x authentication on PSK key mgmt?

Knut Axel Osorio Alayo — Tue, 21 May 2013 21:22:08 GMT

Buenas tardes; Yo tambien tengo el mismo inconveniente, y cuando pongo REMOVE solo se remueve por unos segundos, despues regresa al grupo EXCLUDED CLIENTS, de igual forma he hecho DISABLE, y del grupo DISABLE he hecho REMOVE, pero se excluye nuevamente.

adjunto el mensaje de error.

Client Excluded: MACAddress:9c:b7:0d:2a:5f:cf Base Radio MAC :f4:ea:67:c1:57:10 Slot: 0 User Name: unknown Ip Address: unknown Reason:802.1x Authentication failed 3 times. ReasonCode: 4

Gracias.

802.1x authentication on PSK key mgmt?

Saravanan Lakshmanan — Sat, 25 May 2013 12:06:49 GMT

is there a specific reason to use that 6.0 code, upgrade to latest 7.0.240 code and try to reproduce the issue.

802.1x authentication on PSK key mgmt?

dan.letkeman — Sat, 25 May 2013 13:11:59 GMT

Look at the date of my original post. It is nearly 4 years ago! I don't know why people are responding to this thread.