topic Re: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message wh in Wireless

DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message while in invalid

SHANNON WYATT — Sat, 03 Jul 2021 22:18:30 GMT

I'm working on with a customer on a 2106 controller with 1130 series ap's. Everyting seems fine until the client does a reauthentication. At this point the clients send a stream of authentication attempts to the RADIUS server (40 or so a second). The RADIUS (Microsoft IAS) is passing the authetication. The Controller has the error: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message while in invalid state (0) - version 1, type 3, descriptor 254 with the mac address of the offending client in the log, at the same rate of the authentication storm. The clients have current drivers. We are using the Microsoft supplicant and have the Microsoft updates (SP2 and relevant wireless patches) installed.

I'm currently testing using the Intel supplicant, but have not been doing it long enough to see if it is an issue with that supplicant.

Re: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message wh

m-ketchum — Thu, 10 Apr 2008 03:24:17 GMT

Hi, Any progress with this?

Re: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message wh

SHANNON WYATT — Thu, 10 Apr 2008 08:27:33 GMT

Honestly this was so long ago I don't remember what I did to resolve the issue.

Re: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message wh

murtaza786 — Mon, 23 Jun 2008 13:50:24 GMT

Hi,How did u resolve the isssue ..

Re: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message wh

SHANNON WYATT — Mon, 23 Jun 2008 14:09:52 GMT

It was so long ago that I don't remember.

Re: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message wh

acgri1982 — Tue, 16 Sep 2008 12:20:48 GMT

Does anyone solve this issue??

Re: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message wh

Scott Fella — Tue, 16 Sep 2008 16:11:59 GMT

Is your radius local to the clients or are they authenticating through the WAN?

Re: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message wh

acgri1982 — Tue, 16 Sep 2008 18:19:13 GMT

Is local, in the same LAN. And Cisco Controller is configured with LocalEAP

Re: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message wh

Scott Fella — Tue, 16 Sep 2008 18:23:06 GMT

What type of encryption are you using and also what authentication method? Do you have the same issue if users are on an ssid that is open.. no type of encryption or authentication?

Re: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message wh

acgri1982 — Tue, 16 Sep 2008 18:31:45 GMT

In WLANs > Edit -> Security Layer 2 I'm choosing WPA+WPA2 with TKIP and PSK.

In WLANs > Edit -> AAA Servers, I mark enabled "Local EAP Authentication" with "LocalEAP" EAP profile name.

Then, in Local Net Users > Edit, I fill the fields.

Is this configuration correct?

Re: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message wh

Scott Fella — Wed, 17 Sep 2008 00:25:48 GMT

Okay.... for this wlan ssid, you selected WPA+WPA2. Here you should define either WPA w/ tkip or WPA2 w/ AES.... or both. WPA2 performs better than WPA, but that depends on your client supporting WPA2. Since you selected PSK, you must of entered a pre-shared key. So in the AAA server tab, you don't have to enable local eap authentication.

For local eap, you need to choose wpa+wpa2 and 802.1x. This will also require a certificate on the WLC. I won't go into this too much because you are using PSK. Now on the client side, you would configure the ssid and either wpa tkip or wpa2 aes and psk... not enterprise. Enter you pre-shared key in the client and you should be good to go!

Re: DOT1X-1-INVALID_WPA_KEY_STATE: Received EAPOL-key message wh

charlesnicholas — Wed, 16 Aug 2023 02:45:08 GMT

Hey Scott, I'm having similar issues I believe. I'm using PSK and WPA2+WPA3. These are messages I'm seeing from our controller:

*Dot1x_NW_MsgTask_0: Aug 15 17:01:35.938: %LOG-3-Q_IND: [SA]1x_eapkey.c:3080 Received EAPOL-key message while in invalid state (4) - version 2, type 3, descriptor 2, client x.x.x.x.x.x[...It occurred 2 times.!]

*Dot1x_NW_MsgTask_4: Aug 15 17:01:34.691: %DOT1X-3-INVALID_WPA_KEY_STATE: [SA]1x_eapkey.c:3080 Received EAPOL-key message while in invalid state (4) - version 2, type 3, descriptor 2, client x.x.x.x.x.x