topic Re: Issue connecting Windows 10 Client to network using WPA3 in Wireless

Issue connecting Windows 10 Client to network using WPA3

user2022 — Sun, 08 Aug 2021 04:32:24 GMT

Hi all,

1. I have using C9130AXI-D as EWC and have set Wireless network as WPA3-enterpsie along with GCMP256. I have configured setting on both EWC and Windows 10 client as given in

https://mrncciew.com/2020/08/17/wpa3-enterprise/

2. The configurations were set without error. But when a try to connect to AP I get a message on Windows " Can't connect to this network". I am attaching the log snapshot of EWC for reference. Please help me out.

Re: Issue connecting Windows 10 Client to network using WPA3

Mark Elsen — Sun, 08 Aug 2021 07:11:19 GMT

- What is in the Event Log (eventvwr) , when this happens ?

Re: Issue connecting Windows 10 Client to network using WPA3

user2022 — Sun, 08 Aug 2021 12:19:15 GMT

I am getting these logs

WLAN AutoConfig service failed to connect to a wireless network.

Network Adapter: Intel(R) Wi-Fi 6 AX201 160MHz
Interface GUID: {28b3899e-fb4e-4899-9bf2-5c0771a73990}
Connection Mode: Manual connection with a profile
Profile Name: CWN
SSID: CWN
BSS Type: Infrastructure
Failure Reason:The specific network is not available.
RSSI: 255

But the network SSID is available

Re: Issue connecting Windows 10 Client to network using WPA3

Mark Elsen — Sun, 08 Aug 2021 13:39:06 GMT

- FYI : https://community.intel.com/t5/Wireless/WPA2-Enterprise-unable-to-connect-in-Windows-10-version-2004/m-p/1204484

Re: Issue connecting Windows 10 Client to network using WPA3

user2022 — Sun, 08 Aug 2021 14:04:33 GMT

Thanks for reply. I am able to connect successfully using WPA2-enterprise using same hardware and software.Also I am using Intel AX210 with drivers 22.60.0

Re: Issue connecting Windows 10 Client to network using WPA3

Mark Elsen — Sun, 08 Aug 2021 14:13:29 GMT

Scrutinize the complete article and details. M.

Re: Issue connecting Windows 10 Client to network using WPA3

user2022 — Mon, 09 Aug 2021 07:35:33 GMT

Thanks for the reference. I have studied the complete thread and downloaded latest dev version of Windows 10. But I get same result

Settings

event on windows 10

ssid seen

Re: Issue connecting Windows 10 Client to network using WPA3

Mark Elsen — Mon, 09 Aug 2021 09:00:07 GMT

- Could you try another/lower encryption type (not GCMP256) on both C9130AXI-D and the windows client.

Re: Issue connecting Windows 10 Client to network using WPA3

user2022 — Mon, 09 Aug 2021 09:29:32 GMT

Windows Client only supports GCMP256

Re: Issue connecting Windows 10 Client to network using WPA3

Mark Elsen — Mon, 09 Aug 2021 10:36:59 GMT

>...Windows Client only supports GCMP256

- Further actions may include , using a client which can do the lower ciphers (as a test) , 2) have a full radioactive trace (client debugging) on the controller and last not least engage with cisco TAC.

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/213949-wireless-debugging-and-log-collection-on.html

Presumably a number of features described in the above document may be available on the C9130AXI-D with EWC too.

Re: Issue connecting Windows 10 Client to network using WPA3

patoberli — Mon, 09 Aug 2021 15:28:55 GMT

Which software release is running on the AP? Maybe you're running into a bug.

Re: Issue connecting Windows 10 Client to network using WPA3

user2022 — Tue, 10 Aug 2021 06:52:33 GMT

Re: Issue connecting Windows 10 Client to network using WPA3

patoberli — Tue, 10 Aug 2021 07:13:54 GMT

This is current, very good. In this case please create the radioactive trace as outlined by marce1000.

Re: Issue connecting Windows 10 Client to network using WPA3

user2022 — Tue, 10 Aug 2021 08:11:13 GMT

I am attaching the full radioactive trace. Please see if you help me with it

https://drive.google.com/file/d/17oG-coSZ0PsoC8Nb0OJQ-rDSDn6F7FLy/view?usp=sharing

Re: Issue connecting Windows 10 Client to network using WPA3

Mark Elsen — Tue, 10 Aug 2021 10:40:22 GMT

- Seems this file is not accessible for the general public , I got :

Google drive

Ask for access, or switch to an account with access. Learn more

Re: Issue connecting Windows 10 Client to network using WPA3

user2022 — Tue, 10 Aug 2021 10:54:07 GMT

Sorry for the issue. I have attached the file for your analysis.

https://drive.google.com/file/d/17oG-coSZ0PsoC8Nb0OJQ-rDSDn6F7FLy/view?usp=sharing

Re: Issue connecting Windows 10 Client to network using WPA3

user2022 — Tue, 10 Aug 2021 11:09:43 GMT

File shared again

Re: Issue connecting Windows 10 Client to network using WPA3

patoberli — Tue, 10 Aug 2021 11:12:53 GMT

This is the result of https://cway.cisco.com/wireless-debug-analyzer/

2021/06/28 00:32:06.492	client-orch-sm	Client made a new Association to an AP/BSSID: BSSID 488b.0a93.150f, WLAN CWN, Slot 1 AP 488b.0a93.1500, AP70F0.960C.6294
2021/06/28 00:32:06.493	dot11	Association success for client, assigned AID is: 1
2021/06/28 00:33:36.535	errmsg	Client failed EAP authentication with following reason: Timeout
2021/06/28 00:33:50.001	client-orch-sm	Controller initiated client deletion with code: CO_CLIENT_DELETE_REASON_MN_AP_AUTH_STOP. Code means: Client deletion triggered by the AP due to authentication stop

Without diving to deep into the debug file, is this a WPA3-Enterprise or WPA3-PSK SSID?

Based on the word EAP I tend to say it's WPA3-Enterprise at the moment. If yes, what does the Radius Server logs?

After digging a bit, I also found those error messages:

021/07/03 11:57:47.882573 {wncd_x_R0-0}{1}: [ewlc-infra-evq] [8352]: (note): Authentication Success. Resolved Policy bitmap:11 for client 6c6a.7752.68a9 
2021/07/03 11:58:08.369403 {wncd_x_R0-0}{1}: [radius] [8352]: (ERR): RADIUS/DECODE: No response from radius-server; parse response; FAIL
2021/07/03 11:58:08.369409 {wncd_x_R0-0}{1}: [radius] [8352]: (ERR): RADIUS/DECODE: Case error(no response/ bad packet/ op decode);parse response; FAIL
2021/07/03 11:58:08.369533 {wncd_x_R0-0}{1}: [caaa-authen] [8352]: (ERR): [CAAA:AUTHEN] Authen ctx not found. Authen response freed.
2021/07/03 11:58:26.370853 {wncd_x_R0-0}{1}: [radius] [8352]: (ERR): RADIUS/DECODE: No response from radius-server; parse response; FAIL
2021/07/03 11:58:26.370858 {wncd_x_R0-0}{1}: [radius] [8352]: (ERR): RADIUS/DECODE: Case error(no response/ bad packet/ op decode);parse response; FAIL
2021/07/03 11:58:26.372123 {wncd_x_R0-0}{1}: [errmsg] [8352]: (note): %DOT1X-5-FAIL: Authentication failed for client (6c6a.7752.68a9) with reason (AAA Server Down) on Interface capwap_90000005 AuditSessionID 2901A8C0000000396C3B5DE8 Username: student1
2021/07/03 11:58:26.372326 {wncd_x_R0-0}{1}: [wncd_0] [8352]: (debug): 
CLIENT msg logging has not started
2021/07/03 11:58:26.372635 {wncd_x_R0-0}{1}: [ewlc-infra-evq] [8352]: (ERR): SANET_AUTHC_FAILURE - AAA Server Down username student1, audit session id 2901A8C0000000396C3B5DE8, 
2021/07/03 11:58:26.380464 {wncd_x_R0-0}{1}: [errmsg] [8352]: (note): %SESSION_MGR-5-FAIL: Authorization failed or unapplied for client (6c6a.7752.68a9) on Interface capwap_90000005 AuditSessionID 2901A8C0000000396C3B5DE8. Failure reason: Authc fail. Authc failure reason: AAA Server Down.
2021/07/03 11:58:26.380591 {wncd_x_R0-0}{1}: [wncd_0] [8352]: (debug): 
CLIENT msg logging has not started

It sounds as if you have Radius servers configured for this SSID, correct?

Re: Issue connecting Windows 10 Client to network using WPA3

Mark Elsen — Tue, 10 Aug 2021 11:18:00 GMT

- Look for the authentication-attempts from the particular client (or MAC) in the radius-server logs , check if you can find it and or look for anomalies.

Re: Issue connecting Windows 10 Client to network using WPA3

user2022 — Tue, 10 Aug 2021 16:05:05 GMT

I am using Pfsense with Freeradius. The freeradius work flawlessly with WAP2- enterprise. But when I change to WPA3-enterprise I am not able to connect to the network and there are no logs being generated by freeradius