topic Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK in Wireless

9800-CL WLC Repeated Client Exclusion for Wrong PSK

CARL90 — Mon, 05 Feb 2024 16:58:22 GMT

I've recently inherited a 9800-CL WLC with a somewhat questionable configuration. It seems to be working as expected, however reviewing the Syslog shows regular repeated errors. The error in question is:

%CLIENT_EXCLUSION_SERVER-5-ADD_TO_EXCLUSIONLIST_REASON_DYNAMIC: Chassis 1 R0/0: wncmgrd: Client MAC: dcb5.XX was added to exclusion list associated with AP Name:AP013, BSSID:MAC: 84f1.XX, reason:Wrong PSK

I'm seeing these appear about once per minute or more. The error is thrown repeatedly for the same device every few minutes it appears with a decent number of devices causing the error while on-site. Oddly enough there haven't been any reported issues with disconnects or failure to connect. From what I've found, based on the MAC address every device being reported is an Apple device, almost certainly to be an iPhone that is issued to users. Is there any specific configuration that may have been misconfigured that might cause this issue? Any ideas would be greatly appreciated.

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

Mark Elsen — Mon, 05 Feb 2024 17:24:16 GMT

>... with a somewhat questionable configuration.
- In that context , review the 9800-CL WLC configuration with the CLI command show tech wireless and feed the output into
Wireless Config Analyzer

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

CARL90 — Mon, 05 Feb 2024 17:29:24 GMT

Currently reviewing that report now actually. Nothing too major, and nothing that really explains the current log... might be an Apple specific config issue that's not reported as an error/warning.

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

Mark Elsen — Mon, 05 Feb 2024 17:52:12 GMT

- Ok, I also noted : https://community.cisco.com/t5/wireless/c9800-exclusion-due-to-wrong-psk-macos-clients-only/m-p/4820972#M254968

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

jagan.chowdam — Mon, 05 Feb 2024 18:43:34 GMT

Can you get Radioactive Trace for one of the clients and run it through Cisco Wireless Debug Analyzer and see if it points to any errors
https://cway.cisco.com/wireless-debug-analyzer/

Make sure to capture the radio active trace for complete session.

Jagan Chowdam

/**Please rate helpful responses**/

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

CARL90 — Mon, 05 Feb 2024 20:59:34 GMT

Parsed RA Trace for a single client provided repeating entries of the following:

Time Task Translated
2024/02/05 14:56:21.040 client-orch-sm Client made a new Association to an AP/BSSID: BSSID 84f1.XX, WLAN GUEST, Slot 1 AP 84f1.XX, AP012
2024/02/05 14:56:21.041 dot11 Association success for client, assigned AID is: 10. Client performed fast roam.
2024/02/05 14:56:21.055 client-keymgmt Could not validate MIC received in M2 message
2024/02/05 14:56:21.055 client-keymgmt Fast roam key validation failure on M2
2024/02/05 14:56:22.057 client-keymgmt Could not validate MIC received in M2 message
2024/02/05 14:56:22.057 client-keymgmt Fast roam key validation failure on M2
2024/02/05 14:56:23.055 client-keymgmt Could not validate MIC received in M2 message
2024/02/05 14:56:23.055 client-keymgmt Fast roam key validation failure on M2
2024/02/05 14:56:24.050 client-keymgmt Reached maximum retries for M1
2024/02/05 14:56:24.052 client-orch-sm Controller initiated client deletion with code: CO_CLIENT_DELETE_REASON_NOOP. Explanation: Default code when no other reason is known, it should have been replaced with corresponding delete trigger, internal error. Client will recover after a new session. Actions: Collect RA trace for the client

The advanced debug insights are suggesting that following the client "L2 Authentication Request" there's no logged interactions between the device and the AP/WLC. No authentication failure response, nothing. Which explains the disconnect reason being "NOOP" which apparently is the error for an unreported/unexplained error... Just repeated entries of this association attempt.

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

CARL90 — Mon, 05 Feb 2024 21:08:35 GMT

I had saw this article, but it was specific to Mac OS not iOS like I'm experiencing so I had ruled it out. Also after comparing RA Trace to his, his clients got past layer 2 authentication suggesting it's a different issue. Although looking through the RA trace maybe I need to understand this more. It appears this is the hangup point:

2024/02/05 15:42:05.864	client-keymgmt	Sent M1 for EAPOL 4-Way Handshake
2024/02/05 15:42:05.869	client-keymgmt	Could not validate MIC received in M2 message
2024/02/05 15:42:05.869	client-keymgmt	Fast roam key validation failure on M2
2024/02/05 15:42:06.865	client-keymgmt	Controller did not receive response for M1, sending retransmission

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

jagan.chowdam — Mon, 05 Feb 2024 22:02:59 GMT

Is Cisco Centralized Key Management (CCKM) feature enabled on the SSID? If it is, can you disable it and check.

I've seen connectivity issues with new WiFi 6E apple devices when CCKM enabled on SSID level.

Jagan Chowdam

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

CARL90 — Tue, 06 Feb 2024 15:38:36 GMT

Checked, but no dice. CCKM isn't enabled on any of our SSIDs...

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

Rich R — Sun, 11 Feb 2024 17:12:08 GMT

What version of software are you using?

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

CARL90 — Mon, 12 Feb 2024 13:58:13 GMT

Currently running 17.8.1

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

jagan.chowdam — Mon, 12 Feb 2024 14:48:46 GMT

Cisco IOS XE 17.8.1 is a short-lived release with no MRs planned. For all features and hardware supported starting 17.8.1, you are recommended to use 17.9.4 + SMU_CSCwh87343 + APSP(as needed) OR 17.9.4a + APSP(as needed).

https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214749-tac-recommended-ios-xe-builds-for-wirele.html#toc-hId--897198255

I would upgrade WLC to stable 17.9.4a code to make sure I'm not hitting any bugs.

Jagan Chowdam

/**Please rate helpful responses**/

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

MHM Cisco World — Mon, 12 Feb 2024 14:56:33 GMT

Can i see l2 secuirty of wlan

MHM

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

CARL90 — Mon, 12 Feb 2024 15:01:43 GMT

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

MHM Cisco World — Mon, 12 Feb 2024 15:03:40 GMT

Disbale adptive FT since you use PSK without FT.

MHM

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

CARL90 — Mon, 12 Feb 2024 15:10:37 GMT

Disabled. Still seeing errors reported though...

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

MHM Cisco World — Mon, 12 Feb 2024 15:13:31 GMT

Wait' until the wifi client re-asso or manually disconnected one wifi client (you see it mac in log server) and reconnect again and check log server.

MHM

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

eglinsky2012 — Sun, 11 Aug 2024 03:45:06 GMT

@CARL90- Did you find a resolution to this? I'm having the same issue with some older Paciolan-supplied ticket scanners after moving APs from 8540 to 9800. It's only an issue with these specific scanners. Newer Android-based scanners and my iPhone are able to connect, so I know that the PSK, VLAN, etc. are configured correctly. I did try enabling fast transition with "PSK" and "FT-PSK" as mentioned in another thread with no luck.

We attempted the 9800 migration with 17.9.4 last summer, and we opted to move the needed APs back to the 8540 to get through the school year. We're trying again and it continues on 17.9.5 APSP5. As soon as we move the APs back to the 8540, the scanners connect successfully.

From the debug analyzer:

2024/08/10 22:03:34.524	dot11	Association success for client, assigned AID is: 2. Client performed fast roam.
2024/08/10 22:03:34.540	client-keymgmt	Could not validate MIC received in M2 message
2024/08/10 22:03:34.540	client-keymgmt	Fast roam key validation failure on M2
2024/08/10 22:03:35.539	client-keymgmt	Could not validate MIC received in M2 message
2024/08/10 22:03:35.539	client-keymgmt	Fast roam key validation failure on M2
2024/08/10 22:03:36.557	client-keymgmt	Could not validate MIC received in M2 message
2024/08/10 22:03:36.557	client-keymgmt	Fast roam key validation failure on M2
2024/08/10 22:03:37.536	client-keymgmt	Reached maximum retries for M1
2024/08/10 22:03:37.536	client-orch-sm	Controller initiated client deletion with code: CO_CLIENT_DELETE_REASON_EXCLUDE_WRONG_PSK. Explanation: Client excluded due to wrong PSK password. Actions: Check PSK configuration on client

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

Leo Laohoo — Sun, 11 Aug 2024 06:56:40 GMT

@eglinsky2012

This is beginning to look like CSCvz96924.

Re: 9800-CL WLC Repeated Client Exclusion for Wrong PSK

Rich R — Sun, 11 Aug 2024 23:52:15 GMT

presume you've tried obvious things like different PSK - change/remove special characters, shorten the length of the string etc?